What is the CVSS score of CVE-2026-47086?

CVE-2026-47086 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-47086?

Yes, a patch is available for CVE-2026-47086. Update the affected software to the latest version immediately.

Cyrus IMAP CVE-2026-47086

EUVD-2026-45009 LOW

Incorrect Authorization (CWE-863)

2026-07-16 mitre

GHSA-j6pg-f6px-vgh9

Authentication Bypass Cyrus Imap Cyrusimap

3.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

3.5 LOW

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

vuln.today AI

5.0 MEDIUM

AC:L because issuing GENURLAUTH with a known mailbox name is straightforward for any authenticated user; AC:H in the official vector likely overstates complexity.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 16, 2026 - 20:48 EUVD

Analysis Generated

Jul 16, 2026 - 19:03 vuln.today

DescriptionCVE.org

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.

AnalysisAI

Unauthorized mailbox access in Cyrus IMAP through 3.12.2 allows any authenticated user to read email from mailboxes they have no ACL permissions on by exploiting the GENURLAUTH command's failure to enforce access controls before issuing URLAUTH tokens. The authorization boundary between mailboxes is effectively eliminated for any user who can name a target mailbox, undermining the server's entire multi-user isolation model. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the impact is materially more significant in multi-tenant or shared-server environments than the CVSS score of 3.5 suggests.

Technical ContextAI

Cyrus IMAP (cyrus-imapd), identified by CPE cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:*, is an open-source IMAP server originally developed at Carnegie Mellon University and commonly deployed in academic, ISP, and enterprise mail environments. The URLAUTH extension (RFC 4467) allows authenticated users to generate opaque tokens granting delegated, time-limited access to specific messages - this feature is used by mechanisms such as BURL (RFC 4468) to pass message content between IMAP and SMTP servers without re-uploading data. The GENURLAUTH IMAP command is the mechanism by which a user requests such a token for a given mailbox and message. Correct behavior requires the server to verify that the requesting user holds at minimum read access on the target mailbox (per its ACL) before minting the token. The root cause - CWE-863 (Incorrect Authorization) - is that this ACL enforcement step is absent or bypassed in versions through 3.12.2, meaning the server performs an authorization decision (granting a URLAUTH token) but does so without correctly evaluating whether the requester is entitled to access the named mailbox.

RemediationAI

Upgrade to Cyrus IMAP 3.12.3 or later, which resolves the GENURLAUTH ACL bypass per the vendor release notes at https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html. If upgrading immediately is not feasible, consider disabling URLAUTH support in the Cyrus IMAP configuration if your environment does not rely on IMAP-to-SMTP BURL functionality - this eliminates the attack vector entirely but will break any clients or workflows that depend on RFC 4467 token-based message delegation. A further compensating control is to restrict authenticated IMAP access to only trusted internal users via firewall rules or Cyrus IMAP's access tier configuration, reducing the pool of potential attackers to those already trusted with server access. Consult the full release notes index at https://www.cyrusimap.org/imap/download/release-notes/index.html to determine if a patched release is available for your deployed branch. The fix version 3.12.3 is inferred from the reference URL rather than independently verified vendor advisory language - confirm against your package repository before deploying.