Cyrus IMAP CVE-2026-47086

The attacker must hold a valid authenticated IMAP session on a Cyrus IMAP server running version 3.12.2 or earlier (PR:L per CVSS vector). The URLAUTH/GENURLAUTH extension must be available on the server, which is standard in Cyrus IMAP and not a non-default configuration. The attacker must know or be able to guess the name of the target mailbox - IMAP mailbox names such as 'INBOX' or user-namespace paths (e.g., 'user/alice') are often predictable in practice. The AC:H rating in the CVSS vector indicates some complexity in exploitation conditions, potentially related to the multi-step token issuance and redemption process or specific server configuration nuances. Limiting factors: the attacker must be an authenticated user on the same Cyrus IMAP server (no unauthenticated exploitation path), impact is read-only (I:N, A:N - no modification or deletion of mail is possible via this path), and the scope is limited to mail content accessible through URLAUTH redemption. Non-default configurations do not appear to be required for exploitation.

The CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N scores 3.5 (Low), driven primarily by AC:H and C:L. The scope-changed flag (S:C) reflects that the vulnerability crosses authorization boundaries - from the attacker's own security context into another user's mailbox - which is the most significant signal in the vector. The AC:H rating appears to account for the multi-step nature of URLAUTH token issuance and redemption, or the requirement that the attacker know a valid target mailbox name; however, in practice, IMAP mailbox names (particularly INBOX or user-namespace paths) are often predictable, and this complexity may be overstated. No EPSS data was provided in the input, so exploitation probability cannot be quantified from that signal. The vulnerability is not listed in CISA KEV and no POC has been identified, placing active exploitation risk as low at time of analysis. Despite the low CVSS score, the real-world impact in shared IMAP deployments - where tenant isolation is a core security expectation - is meaningfully higher than the numeric score implies. Organizations running Cyrus IMAP as a multi-user or multi-tenant mail server should treat this as a medium-priority issue operationally, even if it formally scores Low.

An authenticated user on a shared Cyrus IMAP server - such as a student on a university mail system or an employee on a corporate IMAP platform - issues a GENURLAUTH command specifying a target mailbox belonging to another user (e.g., a colleague's INBOX or an administrative shared folder) whose name they know or can guess. The server, failing to enforce ACL validation, returns a valid URLAUTH token for that mailbox. The attacker then redeems this token - via URLFETCH or a compatible mechanism - to fetch message bodies from the target mailbox, reading confidential email without any granted permissions. No public proof-of-concept has been identified at time of analysis.