CVE-2026-47081

{
  "id": "CVE-2026-47081",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-16T19:16:48.573",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a \"mailbox has changed\" notice would be pushed when the mailbox modseq changed."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en cyrus-imapd en Cyrus IMAP hasta la versión 3.12.2. Existe un oráculo de existencia de carpetas XAPPLEPUSHSERVICE y un secuestro de notificaciones push. Un usuario IMAP autenticado podría sondear la existencia de buzones arbitrarios en las cuentas de otros usuarios a través del comando XAPPLEPUSHSERVICE y luego crear notificaciones del Servicio de Notificaciones Push de Apple para correo nuevo en esos buzones a su propio dispositivo APNS. Esto no filtró ningún dato sobre el contenido de los buzones. En su lugar, se enviaría un aviso de ’el buzón ha cambiado’ cuando el modseq del buzón cambiara."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "cyrusimap",
          "product": "Cyrus IMAP",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "3.12.3",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 3.1,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-16T18:30:07.291411Z",
          "id": "CVE-2026-47081",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html",
      "source": "[email protected]"
    },
    {
      "url": "https://www.cyrusimap.org/imap/download/release-notes/index.html",
      "source": "[email protected]"
    }
  ]
}