What is the CVSS score of CVE-2026-47087?

CVE-2026-47087 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-47087?

Yes, a patch is available for CVE-2026-47087. Update the affected software to the latest version immediately.

Cyrus IMAP CVE-2026-47087

EUVD-2026-45010 LOW

Operation on a Resource after Expiration or Release (CWE-672)

2026-07-16 mitre

GHSA-4pcj-qpx3-mjmx

Information Disclosure Cyrus Imap

3.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

3.5 LOW

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

vuln.today AI

3.5 LOW

PR:L reflects that the exploiting party must already hold a minted URLAUTH URL; AC:H captures the timing-dependent revocation prerequisite; S:C because the stale URL crosses an authorization scope boundary.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 16, 2026 - 20:48 EUVD

Analysis Generated

Jul 16, 2026 - 19:02 vuln.today

DescriptionCVE.org

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.

AnalysisAI

Cyrus IMAP through version 3.12.2 fails to invalidate URLAUTH-minted URLs when the authorizer's access is subsequently revoked, allowing continued unauthorized access to delegated mailbox content. The flaw (CWE-672: Operation on Resource after Expiration or Release) affects the URLAUTH extension defined in RFC 4467, which is designed to let users grant third-party access to mailbox data without sharing credentials. No public exploit code exists and this vulnerability is not listed in CISA KEV; real-world risk is highest in environments with active IMAP delegation workflows where access revocation is security-critical, such as departing employee scenarios.

Technical ContextAI

URLAUTH is an IMAP extension (RFC 4467) enabling users - called 'authorizers' - to mint authenticated URLs that grant third parties scoped, credential-free access to specific mailbox data. The root cause is CWE-672: Cyrus IMAP does not re-validate the authorizer's current access rights when a previously issued URLAUTH URL is subsequently used; it relies solely on the token being structurally valid rather than checking live ACL state. The affected software is identified by CPE cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:*, covering all releases through 3.12.2. The Changed Scope (S:C) in the CVSS vector reflects that a successfully exploited URL crosses an authorization boundary - the exploiting party accesses mailbox data under an identity whose rights have been revoked.

RemediationAI

Upgrade to Cyrus IMAP version 3.12.3, which is confirmed by the vendor's official release notes at https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html as containing the fix for this issue. If an immediate upgrade is not feasible, administrators should audit all active URLAUTH tokens and revoke them manually by changing the relevant mailbox ACLs and cycling authorizer credentials - note that this will disrupt any legitimate workflows relying on currently active URLAUTH URLs and will require re-issuance. Organizations that do not use the URLAUTH extension at all can disable or restrict it via IMAP capability advertisement or firewall-level filtering of IMAP URLAUTH commands as a compensating control with minimal operational impact. Environments with strict access revocation requirements (e.g., HR or legal team mailboxes) should treat this as a process control gap and implement post-revocation URLAUTH audits regardless of patch timing.