Cyrus IMAP CVE-2026-47081

The XAPPLEPUSHSERVICE extension must be enabled in the Cyrus IMAP server configuration and the server must be reachable over a network IMAP connection - deployments without APNS integration enabled are unaffected by both the push hijack and the push-based confirmation channel. The attacker must hold valid IMAP credentials on the same Cyrus IMAP server (PR:L per CVSS); unauthenticated attackers cannot reach the XAPS command. Successful mailbox enumeration additionally requires the attacker to guess or derive plausible mailbox path names for target accounts, which the CVSS AC:H rating reflects. The flaw is strictly limited in impact: no message content, sender or recipient metadata, or any other data beyond mailbox existence and modseq-change timing is accessible. Exploitation does not affect the victim's own push notification delivery - the attacker receives an additional, unsolicited notification rather than intercepting the victim's.

The CVSS 3.1 score of 3.1 (Low) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N accurately characterises this as a low-priority finding for most environments. Authentication is required (PR:L), restricting exploitation to users who already hold valid IMAP credentials on the targeted server - this significantly limits the attacker pool. High attack complexity (AC:H) reflects the practical difficulty of guessing valid mailbox paths for other accounts without prior knowledge. The confidentiality impact is genuinely Low (C:L): only structural metadata - mailbox existence and change timing - is disclosed; no message content, headers, or recipient data is reachable through this vector. No EPSS score was provided in the source intelligence, so exploitation probability cannot be quantified. The vulnerability is absent from CISA KEV and no POC code has been identified, indicating no confirmed or widespread active exploitation. Risk is most meaningful in high-security multi-tenant IMAP environments (universities, shared hosting providers) where mailbox enumeration across accounts and unsolicited push notification delivery are meaningful threats, and where APNS integration is actively deployed.

An authenticated IMAP user connects to a shared Cyrus IMAP server and iterates through common mailbox name patterns (e.g., Inbox, Sent, Archives) using the XAPPLEPUSHSERVICE command targeting other users' account namespaces; the server's differential responses confirm which mailboxes exist, revealing organisational folder structure. The attacker then registers their own APNS device token for a confirmed target mailbox, after which every time the victim receives new mail or otherwise changes that folder, the attacker's Apple device receives a 'mailbox has changed' push notification. No public exploit code has been identified, so this currently requires manual IMAP interaction using a standard IMAP client or scripting tool.