CVE-2026-47084
Received Received - Intake

LOCALDELETE ACL Bypass in Cyrus IMAP

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: MITRE

Description
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An authenticated but non-admin user could invoke the admin-only LOCALDELETE IMAP command and delete mailboxes for which they had no permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-16
Last Modified
2026-07-16
Generated
2026-07-16
AI Q&A
2026-07-16
EPSS Evaluated
N/A
NVD
CVE-2026-47084
EUVD
EUVD-2026-45007

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cyrus_imapd cyrus_imapd 3.12.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in cyrus-imapd (Cyrus IMAP) versions up to 3.12.2. It involves the LOCALDELETE command bypassing access control checks. An authenticated user without admin privileges could use this command to delete mailboxes they should not have permission to access.

Detection Guidance

To detect this vulnerability, check Cyrus IMAP logs for unauthorized use of the LOCALDELETE command by non-admin users. Look for IMAP commands containing LOCALDELETE with user permissions below admin level. No specific commands are provided in the context.

Impact Analysis

If you use Cyrus IMAP, an attacker with valid but non-admin credentials could delete mailboxes they shouldn't access. This could lead to data loss, disruption of email services, or unauthorized removal of important emails.

Compliance Impact

This vulnerability could lead to unauthorized data deletion, violating integrity and availability requirements in GDPR and HIPAA. It may result in non-compliance due to potential loss of protected or sensitive data.

Mitigation Strategies

Update cyrus-imapd to version 3.12.2 or later to address the ACL bypass issue in the LOCALDELETE command.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47084. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart