Cyrus IMAP CVE-2026-47084

Exploitation requires a valid, authenticated IMAP session on the Cyrus IMAP server - the attacker must hold any low-privilege user account (PR:L per CVSS vector). No administrative privileges are required; the flaw specifically allows non-admin users to bypass the admin-only restriction on LOCALDELETE. No special server configuration is needed beyond the default deployment of Cyrus IMAP through 3.12.2. Exploitation is limited to authenticated users only - unauthenticated external attackers cannot exploit this without first obtaining credentials. The impact is bounded to mailbox deletion (integrity/availability of mail data); there is no confidentiality exposure (email contents cannot be read via this vector). Organizations where IMAP access is restricted to internal trusted users have materially lower risk than multi-tenant or publicly accessible deployments.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N scores 6.5 (Medium), reflecting network-accessible exploitation by any low-privileged authenticated user with no complexity or interaction barriers. The Integrity:High rating captures unauthorized data deletion, though the A:N rating is debatable - permanent mailbox destruction also represents an availability impact, which this analysis assesses differently (see assessed_cvss_vector). No EPSS score was provided in source data; this is a notable gap. No CISA KEV listing and no known public exploit code exist at time of analysis, which tempers urgency. Despite the medium CVSS score, the real-world risk is meaningful for multi-tenant mail environments (hosted email, universities, ISPs) where untrusted authenticated users coexist with sensitive mailboxes they should not be able to touch. For single-tenant or internally-only-accessible deployments, risk is lower. The attack requires only a valid user credential - a low bar in environments with many accounts.

An attacker with any valid low-privilege IMAP account - for example, a disgruntled employee, a compromised user credential, or an account obtained via phishing - connects to the Cyrus IMAP server over the network and issues a LOCALDELETE command targeting a mailbox belonging to another user or a shared folder. Because ACL validation is not performed for this command, the server processes the deletion without authorization, permanently removing the targeted mailbox and all its contents. No public exploit code has been identified at time of analysis, but the attack requires only standard IMAP client software and knowledge of the command syntax.