Cyrus IMAP CVE-2026-47085

Exploitation requires three concurrent conditions to be satisfied: first, the target must be running Cyrus IMAP version 3.12.2 or earlier with the URLAUTH extension active and reachable; second, the attacker must have obtained knowledge of at least one valid folder name on the victim's IMAP account (e.g., 'INBOX', 'Sent', or a custom folder); and third, the victim user must never have issued a URLAUTH authentication URL for that specific folder - the instant the legitimate user generates any URLAUTH for a folder, a proper random mboxkey is created and stored, eliminating the predictable-key condition for that folder permanently. Exploitation is substantially limited by the near-universal lack of URLAUTH usage in modern IMAP clients (the CVE description notes that perhaps no public clients implement it), the need for prior knowledge of a valid folder name, and the per-folder granularity of the flaw (a forged token for one folder does not expose other folders). The CVSS PR:N metric confirms no attacker authentication is required to submit a URLAUTH token, which is consistent with the RFC 4467 design where tokens are consumed by third-party fetch services rather than authenticated IMAP sessions.

The CVSS 3.1 base score of 4.0 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N reflects a balanced picture: the network attack vector and absence of required attacker authentication (PR:N) lower the barrier to exploitation, while high attack complexity (AC:H) acknowledges the prerequisite knowledge requirements. The scope change metric (S:C) is notable - it signals that a successful attack crosses account boundaries - yet the low confidentiality impact (C:L) caps the score since only mailbox read access is obtained, with no integrity or availability consequences. No EPSS score was included in the intelligence feed, so exploitation probability cannot be quantified. This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public exploit code has been identified, making this a low-urgency finding by all available signals. Critically, the CVE description itself acknowledges that URLAUTH is an obscure feature and that 'perhaps no public clients use URLAUTH,' which drastically reduces real-world attack surface beyond what the CVSS vector alone suggests. For most deployments, this vulnerability will never be reachable because the URLAUTH extension is simply not in active use. Multi-tenant environments such as ISPs and universities running Cyrus IMAP as a shared mail service should prioritize patching given the cross-account nature of a successful exploit.

An attacker who has enumerated or guessed a valid IMAP folder name on a target account - for example, through IMAP LIST responses if unauthenticated enumeration is permitted, or through knowledge of common folder naming conventions - checks whether that folder has ever had a URLAUTH token issued by the legitimate user. If no mboxkey exists for that folder, the attacker computes an HMAC-SHA1 value using the predictable key material and constructs a forged URLAUTH token, which the Cyrus IMAP server validates as authentic, granting read access to that folder's mail contents. No public exploit code exists at time of analysis, but the attack is mechanically straightforward for an adversary who understands the URLAUTH protocol and the mboxkey initialization condition.