CVE-2026-47085 Details
Description
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)
A vulnerability allowing URLAUTH token forgery has been identified in Cyrus IMAP versions through 3.12.2. The issue arises from a missing mboxkey, which could be exploited by an attacker who knows a folder name on the victim's account that has not been associated with an auth URL. By computing an HMAC-SHA1 value with a predictable key, the attacker could forge a URLAUTH token, granting read access to the mailbox. This vulnerability is considered obscure, with a low likelihood of affecting users, as no public clients are known to utilize URLAUTH.
Users can upgrade to Cyrus IMAP version 3.12.3, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 16, 2026CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html | [email protected] | Release NotesVendor |
| https://www.cyrusimap.org/imap/download/release-notes/index.html | [email protected] | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-340 | Generation of Predictable Numbers or Identifiers | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cyrus IMAP | >= 3.12, <= 3.12.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | New CVE Received | [email protected] |
| Jul 16, 2026 | CVE Modified | CISA-ADP |