CVE-2026-47081
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In cyrus-imapd up to version 3.12.2, a vulnerability was found in the XAPPLEPUSHSERVICE command. An authenticated IMAP user can probe for the existence of arbitrary mailboxes on other users' accounts and hijack push notifications for new mail in those mailboxes to their own APNS device.
Risk Assessment
The risk involves privacy breach by revealing the existence of other users' mailboxes and the ability to hijack push notifications, potentially leaking information about mailbox activity (e.g., modseq changes) without accessing message content.
Recommendation
It is recommended to immediately upgrade cyrus-imapd to a version later than 3.12.2, which includes a fix for the vulnerability in the XAPPLEPUSHSERVICE command.
Other vulnerabilities in cyrus-imapd
See all- CVE-2026-47085Medium
An issue in cyrus-imapd up to version 3.12.2 allows URLAUTH token forgery. An attacker who knows a victim's folder name for which no auth URL was ever issued can compute a valid HMAC-SHA1 token with a predictable key, gaining read access to the mailbox.
- CVE-2026-47083Medium
An issue was discovered in cyrus-imapd up to version 3.12.2 in the ESEARCH command. An authenticated IMAP user can enumerate folder names in any account they can name, leading to information disclosure about the mailbox structure.
Original NVD description (English source)
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS