What is the CVSS score of CVE-2026-47084?

CVE-2026-47084 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-47084?

Yes, a patch is available for CVE-2026-47084. Update the affected software to the latest version immediately.

Cyrus IMAP CVE-2026-47084

EUVD-2026-45007 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-16 mitre

GHSA-324f-35v9-jxhh

Authentication Bypass Red Hat Suse Cyrus Imap Cyrusimap

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

8.1 HIGH

Mailbox deletion permanently destroys data and removes user access, warranting A:H alongside I:H; all other metrics align with the provided vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 16, 2026 - 20:48 EUVD

Analysis Generated

Jul 16, 2026 - 19:01 vuln.today

DescriptionCVE.org

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An authenticated but non-admin user could invoke the admin-only LOCALDELETE IMAP command and delete mailboxes for which they had no permissions.

AnalysisAI

Unauthorized mailbox deletion in Cyrus IMAP through 3.12.2 allows any authenticated non-admin user to invoke the admin-only LOCALDELETE command, bypassing ACL enforcement entirely. Any user with a valid account on an affected server can permanently delete arbitrary mailboxes - including those they have no read, write, or administrative permissions over - simply by issuing the improperly guarded command. No public exploit has been identified at time of analysis, but the attack requires only authentication and knowledge of the command, making it low-complexity for any insider or account-compromised attacker.

Technical ContextAI

Cyrus IMAP (cyrus-imapd) is a widely deployed open-source IMAP server maintained by the Cyrus project at Carnegie Mellon University. The affected component is the LOCALDELETE IMAP command, which is intended exclusively for administrative use in mailbox replication and migration workflows. The root cause is CWE-863 (Incorrect Authorization): the server fails to enforce access control checks when processing LOCALDELETE, meaning the privilege boundary between regular authenticated users and administrators is not validated at the command-dispatch layer. Affected versions span all releases up to and including 3.12.2 per CPE cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:*, and the fix appears in 3.12.3 based on the referenced release notes URL.

RemediationAI

Upgrade to Cyrus IMAP 3.12.3, which addresses the ACL enforcement gap for the LOCALDELETE command per the vendor release notes at https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html. For installations on older release branches (3.10.x, 3.8.x, etc.), check the release notes index at https://www.cyrusimap.org/imap/download/release-notes/index.html for branch-specific patches. If an immediate upgrade is not possible, a compensating control is to restrict IMAP access so that only trusted administrative accounts can reach the Cyrus IMAP service at the network layer (firewall, VPN, or authenticated proxy), trading off legitimate multi-user access. Another option is to audit and restrict the set of accounts permitted to authenticate directly to the IMAP service, reducing the pool of principals who could abuse LOCALDELETE. Neither workaround eliminates the underlying flaw - patching to 3.12.3 or a backported fix is the only definitive remediation.