CVE-2026-47086

{
  "id": "CVE-2026-47086",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-16T19:16:49.253",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en cyrus-imapd en Cyrus IMAP hasta la versión 3.12.2. Los tokens emitidos por GENURLAUTH pueden eludir las ACLs. Cualquier usuario autenticado podría generar un token URLAUTH (a través del comando GENURLAUTH) para cualquier buzón que pudiera nombrar, incluso sin tener acceso de lectura sobre él. Esto permitiría leer correo de los buzones a pesar de no tener permisos concedidos."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "cyrusimap",
          "product": "Cyrus IMAP",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "3.12.3",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "baseScore": 3.5,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-16T18:46:52.503524Z",
          "id": "CVE-2026-47086",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html",
      "source": "[email protected]"
    },
    {
      "url": "https://www.cyrusimap.org/imap/download/release-notes/index.html",
      "source": "[email protected]"
    }
  ]
}