PT-2026-60554 · Cyrusimap · Cyrus Imap

CVE-2026-47086 · Publicado 2026-07-16 · Atualizado 2026-07-16

NVD

CVSS v3.1

3.5

Baixa

Vetor base

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-47086

Produtos afetados

Cyrus Imap

Referências · 3

• https://cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html · Nota
• https://cyrusimap.org/imap/download/release-notes/index.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-47086 · Nota de Segurança