CVE-2026-47085

{
  "id": "CVE-2026-47085",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-16T19:16:49.120",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)"
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en cyrus-imapd en Cyrus IMAP hasta la versión 3.12.2. La falsificación de tokens URLAUTH puede ocurrir a través de una mboxkey faltante. Si un atacante conociera el nombre de una carpeta en la cuenta de la víctima para la cual la víctima nunca había emitido una URL de autenticación, podría falsificar un token URLAUTH funcional calculando un valor HMAC-SHA1 con una clave predecible, dándoles acceso de lectura al buzón. (URLAUTH es una característica oscura, lo que significa que las probabilidades de que cualquier usuario sea realmente susceptible a este ataque son muy bajas. Quizás ningún cliente público use URLAUTH)."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "cyrusimap",
          "product": "Cyrus IMAP",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "3.12.3",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
          "baseScore": 4.0,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-16T18:54:08.396648Z",
          "id": "CVE-2026-47085",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-340"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html",
      "source": "[email protected]"
    },
    {
      "url": "https://www.cyrusimap.org/imap/download/release-notes/index.html",
      "source": "[email protected]"
    }
  ]
}