CVE-2026-47089

MEDIUM

Cyrusimap Cyrus Imap < 3.12.3 - Missing Authorization

Title source: rule

Description

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)

References (2)

Core 2

Core References

https://www.cyrusimap.org/imap/download/release-notes/index.html

https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html

Scores

CVSS v3 4.3

EPSS 0.0018

EPSS Percentile 7.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (1)

cyrusimap/Cyrus IMAP < 3.12.3

Published Jul 16, 2026

Tracked Since Jul 17, 2026