What is the CVSS score of CVE-2026-47081?

CVE-2026-47081 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-47081?

Yes, a patch is available for CVE-2026-47081. Update the affected software to the latest version immediately.

Cyrus IMAP CVE-2026-47081

EUVD-2026-45004 LOW

Incorrect Authorization (CWE-863)

2026-07-16 mitre

GHSA-w8cp-9j4g-wc9p

Authentication Bypass Apple Oracle Cyrus Imap Cyrusimap

3.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

Network IMAP access required (AV:N); authentication mandatory (PR:L); guessing foreign mailbox names adds complexity (AC:H); only existence metadata disclosed, no content (C:L, I:N, A:N).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 16, 2026 - 20:48 EUVD

Analysis Generated

Jul 16, 2026 - 18:46 vuln.today

CVE Published

Jul 16, 2026 - 00:00 cve.org

LOW 3.1

DescriptionCVE.org

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed.

AnalysisAI

Cyrus IMAP through version 3.12.2 contains an authorization flaw in its XAPPLEPUSHSERVICE (XAPS) command that lets authenticated IMAP users enumerate arbitrary mailboxes belonging to other accounts and redirect Apple Push Notification Service alerts about those mailboxes to their own device. The flaw (CWE-863, Incorrect Authorization) does not expose message content - only whether a target mailbox exists and when its modification sequence (modseq) changes - but it enables cross-account probing and unauthorized push subscription in multi-tenant IMAP deployments. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the low CVSS score of 3.1 is consistent with the limited confidentiality impact and mandatory authentication requirement.

Technical ContextAI

XAPPLEPUSHSERVICE (XAPS) is a proprietary IMAP extension supported by Cyrus IMAP that enables Apple Mail clients to register Apple Push Notification Service (APNS) device tokens, allowing the server to push 'new mail' notifications to iOS and macOS devices without the client maintaining a persistent connection. The vulnerability arises because Cyrus IMAP's XAPS command handler does not enforce proper ownership or access-control checks (CWE-863: Incorrect Authorization) before accepting a mailbox path submitted by the authenticated user. As a result, any authenticated IMAP user can supply arbitrary mailbox paths - including those belonging to other accounts - and the server's acceptance or rejection reveals whether those mailboxes exist. Furthermore, by successfully registering a foreign mailbox, the attacker's APNS device token receives 'mailbox changed' push notifications whenever the victim mailbox's modseq advances. The affected codebase is cyrusimap/cyrus-imapd, identified by CPE cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:*, covering all releases through 3.12.2.

RemediationAI

The primary remediation is to upgrade Cyrus IMAP to version 3.12.3 or later, which addresses this vulnerability according to the vendor release notes at https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html; consult https://www.cyrusimap.org/imap/download/release-notes/index.html for status of other supported branches. If an immediate upgrade is not feasible, administrators can disable the XAPPLEPUSHSERVICE extension in the Cyrus IMAP configuration, which eliminates both the enumeration oracle and the push hijack surface entirely - the trade-off is that all Apple Mail push notification functionality will cease for every user on the server. As an additional layer, restricting IMAP access via firewall rules or VPN to known-good authenticated networks reduces the pool of potential attackers able to exploit this, though it does not eliminate the flaw for internal users. No patch version beyond 3.12.3 has been independently confirmed from the provided data.