Cyrus IMAP CVE-2026-47087

Exploitation requires three concurrent conditions: (1) the URLAUTH IMAP extension must be in active use on the target server, (2) an authorizer must have previously minted a URLAUTH URL and that URL must be in the possession of a third party, and (3) the authorizer's access must subsequently be revoked (via ACL removal, account deletion, or password change) while the URL remains unexpired. The CVSS High Attack Complexity (AC:H) directly captures this timing dependency. Exploitation is entirely blocked if the URLAUTH feature is not used, if no URLs were issued prior to the revocation event, or if the server has been upgraded to 3.12.3. The exploiting party must already possess a legitimately issued URLAUTH URL (PR:L), which limits the attack surface to known recipients of prior delegations rather than arbitrary network attackers.

The CVSS 3.1 score of 3.5 (Low) with vector AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N accurately reflects the limited but real risk profile. High Attack Complexity (AC:H) captures the timing-dependent prerequisite: access revocation must occur after a URLAUTH URL has already been issued and is in the possession of a third party. Low Privileges (PR:L) indicates that exploitation requires the exploiting party to already hold a previously minted URL, meaning the attack is not opportunistic. The impact is bounded to Low Confidentiality - read access to specific delegated mailbox content - with no integrity or availability impact. No EPSS score was provided in the input data, and this vulnerability is not in CISA KEV, nor is any public exploit code identified. This is a genuine low-severity finding, not a high-CVSS distortion; however, its impact is disproportionately significant in high-trust delegation environments (academic institutions, legal or HR teams) where stale access after personnel changes carries compliance and confidentiality implications.

A user delegates mailbox access by issuing a URLAUTH URL to a colleague or automated system; later, the authorizer's account is disabled or their ACL is removed following a role change or departure. The recipient retains the original URL and continues to successfully fetch mailbox content via that stale URLAUTH token, bypassing the intended access revocation. No exploit code is required - the flaw is triggered by any standard IMAP URLFETCH command using a previously minted URL against a patched server.