CVE-2026-47087
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor...
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
- Record
CVE-2026-47087- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-672
- Updated
- 2026-11-02
EUVDEUVD-2026-45010
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
- Record
EUVD-2026-45010- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4pcj-qpx3-mjmx
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor...
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
- Record
GHSA-4pcj-qpx3-mjmx- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-672
- Updated
- 2026-11-02
NVD
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
- Record
CVE-2026-47087- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-672
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-47087
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
- Record
DEBIAN-CVE-2026-47087- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-47087
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
- Record
UBUNTU-CVE-2026-47087- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21368-1 No score
Security update for cyrus-imapd
This update for cyrus-imapd fixes the following issues:
Changes in cyrus-imapd:
- Update to 3.8.7 (bugfix release)
- CVE-2026-47081: XAPPLEPUSHSERVICE folder existence oracle and push hijack (bsc#1271617)
- CVE-2026-47083: ESEARCH cross-user content oracle (bsc#1271619)
- CVE-2026-47082: Vacation "fcc" skips destination-mailbox ACL (bsc#1271618)
- CVE-2026-47084: LOCALDELETE bypassed ACL checks (bsc#1271620)
- CVE-2026-47085: URLAUTH token forgery via missing mboxkey (bsc#1271621)
- CVE-2026-47086: GENURLAUTH issued tokens bypassing ACLs (bsc#1271622)
- CVE-2026-47087: URLAUTH does not honor revoked authorizer access (bsc#1271623)
- CVE-2026-47088: Heap exposure in nested MIME comment parsing (bsc#1271624)
- CVE-2026-47089: LISTRIGHTS not limited to users with admin access (bsc#1271625)
- Record
openSUSE-SU-2026:21368-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cyrus-imapdDebian:12 |
before 3.6.1-4+deb12u5, plus listed versions 3.6.1-43.6.1-4+deb12u13.6.1-4+deb12u23.6.1-4+deb12u33.6.1-4+deb12u4 |
3.6.1-4+deb12u5 |
cyrus-imapdDebian:13 |
before 3.10.2-1+deb13u2, plus listed versions 3.10.2-13.10.2-1+deb13u1 |
3.10.2-1+deb13u2 |
cyrus-imapdDebian:14 |
before 3.12.3-1, plus listed versions 3.10.2-13.12.0-13.12.0-23.12.1-13.12.1-23.12.1-33.12.2-13.12.3-1~bpo13+1 |
3.12.3-1 |
cyrus-imapdUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.5.10-3build12.5.10-3build22.5.10-3ubuntu12.5.10-3ubuntu1.12.5.10-3ubuntu1.1+esm1 |
None known |
cyrus-imapdUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.0.11-13.0.11-1build13.0.12-13.0.12-23.0.12-2ubuntu2 Show 7 moreShow less3.0.12-2ubuntu33.0.13-2ubuntu13.0.13-3ubuntu13.0.13-4ubuntu13.0.13-53.0.13-5ubuntu0.1~esm13.0.13-5ubuntu0.1~esm2 |
None known |
cyrus-imapdUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.2.6-2build13.4.2-23.4.2-2build13.4.3-23.4.3-3 Show 5 moreShow less3.4.3-3build23.4.3-3ubuntu0.13.4.3-3ubuntu0.1+esm13.4.3-3ubuntu0.33.4.3-3ubuntu0.3+esm1 |
None known |
cyrus-imapdUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 3.8.0-53.8.1-13.8.1-1build13.8.1-1build23.8.1-3 Show 5 moreShow less3.8.1-3build33.8.2-13.8.2-1ubuntu0.1~esm13.8.2-1ubuntu0.23.8.2-1ubuntu0.2+esm1 |
None known |
cyrus-imapdUbuntu:26.10 |
All versions, plus listed versions 3.12.1-33.12.2-13.12.2-1build13.12.3-3build1 |
None known |
cyrus-imapdUbuntu:26.04:LTS |
All versions, plus listed versions 3.10.2-13.12.1-23.12.1-2build13.12.1-3 |
None known |
cyrus-imapdopenSUSE:Leap 16.0 From an advisory covering 9 CVEs |
before 3.8.7-bp160.1.1 | 3.8.7-bp160.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-47087 is a low vulnerability (CVSS 3.5) in Cyrusimap Cyrus Imap, published July 16, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in cyrus-imapd 3.6.1-4+deb12u5.
References
cyrusimap.org/imap/download/release-notes/index.html
nvd.nist.gov/vuln/detail/CVE-2026-47087
github.com/advisories/GHSA-4pcj-qpx3-mjmx
security-tracker.debian.org/tracker/CVE-2026-47087
ubuntu.com/security/CVE-2026-47087
Show 19 moreShow less
cve.org/CVERecord?id=CVE-2026-47087
bugzilla.suse.com/1271617
suse.com/security/cve/CVE-2026-47081