CVE-2026-47085
MediumCVSS 4.0Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
An issue in cyrus-imapd up to version 3.12.2 allows URLAUTH token forgery. An attacker who knows a victim's folder name for which no auth URL was ever issued can compute a valid HMAC-SHA1 token with a predictable key, gaining read access to the mailbox.
Risk Assessment
The risk is low because URLAUTH is an obscure feature and the attack requires knowledge of a specific folder name. However, if exploited, an attacker could read the victim's mailbox contents.
Recommendation
Upgrade cyrus-imapd to version 3.12.3 or later, which includes the fix. If upgrading is not possible, consider disabling the URLAUTH feature in the server configuration.
Other vulnerabilities in cyrus-imapd
See all- CVE-2026-47083Medium
An issue was discovered in cyrus-imapd up to version 3.12.2 in the ESEARCH command. An authenticated IMAP user can enumerate folder names in any account they can name, leading to information disclosure about the mailbox structure.
- CVE-2026-47081Low
In cyrus-imapd up to version 3.12.2, a vulnerability was found in the XAPPLEPUSHSERVICE command. An authenticated IMAP user can probe for the existence of arbitrary mailboxes on other users' accounts and hijack push notifications for new mail in those mailboxes to their own APNS device.
Original NVD description (English source)
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)