docker-mailbox CVE-2026-82973

Exploitable only when bearer-token authentication is NOT configured on the docker-mailbox instance (before version 0.4.13); with bearer-token auth enabled the unauthenticated remote path is closed. The attacker must be able to reach the service's API and supply attacker-controlled folder, UID, or search parameter values that are passed into IMAP command construction; the service must already hold an authenticated upstream mailbox connection for the injected commands to take effect. No user interaction is required. The principal limiting factors are the non-default requirement of running without bearer-token auth and the extremely small deployment base of this niche project.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H = 9.4) describes a network-reachable, low-complexity, unauthenticated IMAP command-injection flaw with high integrity and availability impact - on paper a critical issue. However, the raw score must be tempered by two independent signals. First, the unauthenticated path is conditional: it only applies 'when bearer-token authentication is not configured,' so deployments that enable bearer-token auth are not remotely-unauthenticated-exploitable, which the base PR:N does not capture. Second, exploitation status is weak: there is no CISA KEV listing, no EPSS score, and no public exploit identified at time of analysis - the only reference is the vendor's own patch commit. This points to a real but not yet actively-exploited vulnerability. The dominant limiting factor is product footprint: psyb0t/docker-mailbox is an obscure personal GitLab project, so despite the 9.4 score this is a low real-world-priority issue except for the handful of environments actually running it without bearer-token auth. No SSVC data was provided; automatable/exploitation-status fields are inferred only from the CVSS vector and description.

A remote attacker targets a docker-mailbox instance that has been deployed without bearer-token authentication configured, submitting an API request whose folder, UID, or search parameter embeds CRLF (\r\n) sequences. Because these values are inserted unsanitized into IMAP commands sent over the service's already-authenticated upstream mailbox connection, the injected line is executed as an additional IMAP command, letting the attacker read, alter, or delete mail in that mailbox. No public exploit code has been identified; only the vendor fix commit is referenced.