An authenticated IMAP user can use the XAPPLEPUSHSERVICE command to determine whether arbitrary mailboxes exist in other users’ accounts, and if so, create Apple Push Notification Service alerts for those mailboxes that will trigger on changes. The attack does not reveal the contents of the mailbox, but exposes the existence of mailbox directories and permits the attacker to hijack push notifications for new mail. The weakness is caused by a missing access control check before the operation, resulting in a folder existence oracle (CWE‑497) and a privilege escalation that allows an authenticated user to create push notifications for other users’ mailboxes (CWE‑863).

The problem exists in Cyrus IMAP releases through version 3.12.2. Users running any of those versions are affected; later releases such as 3.12.3 contain a fix, as documented in the 3.12.3 release notes.

The CVSS score of 3.1 indicates low overall severity, and the EPSS score of less than 1% means the probability of real‑world exploitation is very low. The vulnerability is not listed in the CISA KEV catalog. Attackers would need an authenticated IMAP session, which could be achieved by compromising an existing user account or by gaining credentials through phishing or other means. Once authenticated, the attacker can probe mailbox existence across the server and hijack push notifications, thereby learning a victim’s mailbox structure and potentially affecting notification delivery.