CVE-2026-47082
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In cyrus-imapd up to version 3.12.2, the vacation 'fcc' feature bypasses the destination mailbox ACL check. A user with a vacation Sieve script using :fcc can deliver auto-reply copies to any mailbox, regardless of insert permissions.
Risk Assessment
The risk involves unauthorized message delivery to arbitrary mailboxes, potentially leading to data confidentiality breaches, mailbox overflow, or use in spam attacks.
Recommendation
Immediately upgrade cyrus-imapd to version 3.12.3 or later, which includes a fix for this ACL bypass.
Other vulnerabilities in Cyrus IMAP
See all- CVE-2015-8077High
Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the start_octet variable.
- CVE-2015-8076High
The index_urlfetch function in Cyrus IMAP versions 2.3.x before 2.3.19, 2.4.x before 2.4.18, and 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or possibly have unspecified other impact via vectors related to the urlfetch range, which triggers an out-of-bounds heap read.
- CVE-2017-14230Critical
In the mboxlist_do_find function in Cyrus IMAP before version 3.0.4, an off-by-one error in prefix calculation for the LIST command led to the use of uninitialized memory. This may allow remote attackers to obtain sensitive information or cause a daemon crash.
- CVE-2026-47089Medium
In cyrus-imapd up to version 3.12.2, the LISTRIGHTS command was not restricted to users with admin access. An authenticated user could call LISTRIGHTS against any mailbox they could name and learn what principals had what access to it.
- CVE-2026-47088Low
In cyrus-imapd up to version 3.12.2, a vulnerability was discovered involving heap exposure during parsing of nested MIME comments. An authenticated IMAP user can craft an email message containing an RFC 822 comment ending with a backslash, causing the server to read past the message's end in memory and return heap content.
- CVE-2026-47087Low
In cyrus-imapd up to version 3.12.2, an issue was discovered where URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
- CVE-2026-47086Low
In cyrus-imapd up to version 3.12.2, a vulnerability allows GENURLAUTH-issued tokens to bypass ACLs. Any authenticated user can mint a URLAUTH token for any mailbox they can name, even without read access, enabling reading of mail from that mailbox.
- CVE-2026-47084Medium
In cyrus-imapd up to version 3.12.2, a vulnerability was found where the LOCALDELETE command bypassed ACL checks. An authenticated non-admin user could invoke the admin-only LOCALDELETE IMAP command and delete mailboxes for which they had no permissions.
Original NVD description (English source)
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.