What is the CVSS score of CVE-2026-47082?

CVE-2026-47082 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-47082?

Yes, a patch is available for CVE-2026-47082. Update the affected software to the latest version immediately.

Cyrus IMAP CVE-2026-47082

EUVD-2026-45005 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-16 mitre

GHSA-pwfr-vrq6-chw9

Authentication Bypass Red Hat Suse Cyrus Imap Cyrusimap

5.4

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

PR:L because a valid authenticated account and ManageSieve write access are required; C:N because the flaw enables write-only mailbox injection, not read access; I:L and A:L reflect unauthorized message delivery and potential mailbox flooding.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jul 16, 2026 - 20:48 EUVD

Analysis Generated

Jul 16, 2026 - 19:01 vuln.today

DescriptionCVE.org

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.

AnalysisAI

Incorrect authorization in Cyrus IMAP through 3.12.2 allows authenticated users to bypass mailbox ACL enforcement via the vacation Sieve script :fcc (file carbon copy) feature, enabling unauthorized message injection into any mailbox nameable by the script regardless of insert permissions. The CVSS vector (PR:L, AV:N) confirms network-triggerable exploitation requiring only a valid authenticated account, with low integrity and availability impact (C:N/I:L/A:L). No public exploit code and no CISA KEV listing exist at time of analysis; vendor-released patch version 3.12.3 addresses the flaw.

Technical ContextAI

Cyrus IMAP (cyrus-imapd) is an open-source IMAP/POP3 server with Sieve email filtering support. The Sieve vacation extension allows users to configure auto-replies when absent, optionally using the :fcc parameter to save a file carbon copy of each sent reply to a specified mailbox. The vulnerability (CWE-863: Incorrect Authorization) lies in the vacation fcc processing code path: when writing the fcc copy to the target mailbox, the server fails to verify that the Sieve script owner holds the Cyrus ACL i (insert) right on the destination mailbox. The authorization step is present elsewhere but is incorrectly skipped for this specific delivery path. Affected CPE: cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:* with an upper-bound version of 3.12.2.

RemediationAI

Upgrade Cyrus IMAP to version 3.12.3 or later, which contains the ACL enforcement fix per the vendor release notes at https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html. If immediate upgrade is not feasible, administrators can mitigate by disabling the Sieve vacation :fcc capability at the server level - this can be done by removing the fcc or vacation-fcc capability from the allowed Sieve extensions in the Cyrus configuration; the trade-off is that vacation fcc functionality will be unavailable to all users. A more targeted control is to restrict ManageSieve access so only trusted users can upload or modify Sieve scripts, reducing the attacker pool; however, this also limits self-service vacation configuration. Blocking or auditing Sieve scripts that reference :fcc with external mailbox paths is not natively supported and would require custom tooling.