What is the CVSS score of CVE-2026-47089?

CVE-2026-47089 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-47089?

Yes, a patch is available for CVE-2026-47089. Update the affected software to the latest version immediately.

Cyrus IMAP CVE-2026-47089

EUVD-2026-45012 MEDIUM

Missing Authorization (CWE-862)

2026-07-16 mitre

GHSA-fx86-vr4x-grgq

Authentication Bypass Red Hat Suse Cyrus Imap Cyrusimap

4.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

PR:L required as any authenticated user triggers the flaw; C:L reflects ACL metadata disclosure only, with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 16, 2026 - 20:48 EUVD

Analysis Generated

Jul 16, 2026 - 19:03 vuln.today

DescriptionCVE.org

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)

AnalysisAI

Cyrus IMAP through 3.12.2 exposes mailbox ACL data to any authenticated user via the IMAP LISTRIGHTS command, which lacks the required admin-access authorization check. Any valid IMAP account holder can call LISTRIGHTS against arbitrary mailboxes they can name, learning which principals hold which access rights - data that should be restricted to mailbox administrators. No public exploit or active exploitation has been identified; vendor release notes reference 3.12.3 as the corrective release.

Technical ContextAI

CWE-862 (Missing Authorization) describes the root cause: the LISTRIGHTS IMAP command (defined in RFC 4314 as part of the IMAP ACL extension) is intended to return the rights a given identifier holds on a specified mailbox. In a correctly implemented server, querying ACL data on mailboxes the caller does not administer should require elevated (admin) privilege on that mailbox. Cyrus IMAP through 3.12.2 omits this authorization gate entirely, allowing any authenticated session to probe the full ACL map of any reachable mailbox by name. The affected CPE is cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:*, covering all versions of the cyrusimap open-source IMAP server product up to and including 3.12.2.

RemediationAI

Upgrade to Cyrus IMAP 3.12.3, which is indicated as the corrective release per vendor release notes at https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html. If an immediate upgrade is not feasible, restrict IMAP service access at the network layer (firewall or VPN) to reduce the population of users who can authenticate and issue LISTRIGHTS commands - noting this trade-off limits remote IMAP access generally, not just the vulnerable command. Additionally, audit existing mailbox ACL configurations to ensure sensitive mailbox permission assignments do not inadvertently expose organizational or privilege structures; minimizing ACL breadth reduces the value of information disclosed by this flaw. There is no known per-command disable switch for LISTRIGHTS in Cyrus IMAP without patching.