CVE-2026-47087
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In cyrus-imapd up to version 3.12.2, an issue was discovered where URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
Risk Assessment
The risk is that a user whose access has been revoked can still access protected mail resources using a previously generated URLAUTH URL, violating access control and potentially leading to data leakage.
Recommendation
It is recommended to immediately upgrade cyrus-imapd to the latest version that includes a fix for this vulnerability. Also review and invalidate all existing URLAUTH URLs for users whose access has been revoked.
Original NVD description (English source)
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.