CVE-2026-47086
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In cyrus-imapd up to version 3.12.2, a vulnerability allows GENURLAUTH-issued tokens to bypass ACLs. Any authenticated user can mint a URLAUTH token for any mailbox they can name, even without read access, enabling reading of mail from that mailbox.
Risk Assessment
The risk involves unauthorized access to sensitive email messages within the organization, potentially leading to data leakage and privacy breaches.
Recommendation
It is recommended to immediately upgrade cyrus-imapd to a version later than 3.12.2, which includes a fix for this vulnerability.
Original NVD description (English source)
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.