CVE-2026-47086
Received Received - Intake

URLAUTH Token ACL Bypass in Cyrus IMAP

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: MITRE

Description
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-16
Last Modified
2026-07-16
Generated
2026-07-16
AI Q&A
2026-07-16
EPSS Evaluated
N/A
NVD
CVE-2026-47086
EUVD
EUVD-2026-45009

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cyrus_imapd cyrus_imapd 3.12.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Cyrus IMAP through 3.12.2 allows authenticated users to bypass Access Control Lists (ACLs) by exploiting GENURLAUTH-issued tokens. Users can create URLAUTH tokens for any mailbox they name, even without read permissions, enabling unauthorized access to mail contents.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to read emails from restricted mailboxes, potentially exposing sensitive information. It undermines data confidentiality and trust in the email system.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (health information privacy) by enabling unauthorized access to sensitive data, resulting in legal penalties and reputational damage.

Mitigation Strategies

Upgrade cyrus-imapd to a version beyond 3.12.2 where this issue is resolved. Review and restrict GENURLAUTH token usage to authorized users only. Audit existing tokens and revoke any suspicious ones.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47086. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart