Cyrus IMAP CVE-2026-47089

Requires a valid IMAP credential for any ordinary user account on the target Cyrus IMAP server (PR:L per CVSS vector - unauthenticated access is insufficient). The attacker must have network access to the IMAP service (typically TCP 143 for IMAP or 993 for IMAPS) and must supply one or more mailbox names to query - names may be guessed, harvested from directory services, or derived from email addresses. No non-default configuration is required; the missing authorization check is present in default deployments through 3.12.2. Exploitation is bounded to disclosure of ACL metadata (which principals hold which rights); message content, credentials, and server configuration are not exposed by this command. The flaw does not grant the attacker any additional mailbox access rights - only knowledge of existing ACL assignments.

The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects the constrained impact: network-reachable with low complexity but requiring authentication (PR:L), with only limited confidentiality impact and no integrity or availability loss. No EPSS data was provided, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation. No public POC has been identified at time of analysis. The practical risk is most significant in multi-tenant, ISP-hosted, or large enterprise deployments where ACL structures may inadvertently reveal organizational hierarchy, service account assignments, or the presence of privileged mailboxes - intelligence useful for subsequent targeted attacks. In single-user or tightly access-controlled deployments, real-world risk is minimal. This is a genuine but moderate-priority finding: the flaw is real and exploitable by any authenticated user, but the disclosed data is metadata rather than message content.

An authenticated IMAP user connects to a Cyrus IMAP 3.12.2 server over port 143 or 993, then systematically issues LISTRIGHTS commands against known or guessed mailbox names - including executive, shared-service, or administrative mailboxes. The server returns ACL breakdowns without checking admin rights on those mailboxes, allowing the attacker to map which user accounts or service principals hold elevated access, identifying high-value targets for credential theft or further privilege escalation. No POC has been publicly identified, but the IMAP protocol interaction is straightforward for any authenticated user.