CVE-2026-47086lowCWE-863

CVE-2026-47086: falha de baixa gravidade em cyrusimap Cyrus IMAP

Publicada em

Seguir esta CVE+ Monitorar Cyrus IMAP+ Monitorar cyrus-imapd

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.5epss 0.3%
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Produtos afetados
cyrusimap · Cyrus IMAP
CVEs relacionadas — cyrusimap Cyrus IMAP

No mesmo produto, das mais perigosas para as menos.

CVE-2026-47084MEDIUMCVE-2026-47084EPSS 0.3%CVE-2026-47083MEDIUMCVE-2026-47083EPSS 0.3%CVE-2026-47082MEDIUMCVE-2026-47082EPSS 0.3%CVE-2026-47085MEDIUMCVE-2026-47085EPSS 0.3%CVE-2026-47087LOWCVE-2026-47087EPSS 0.3%CVE-2026-47089MEDIUMCVE-2026-47089EPSS 0.3%