CVE-2026-47085

cyrus-imapd: Cyrus IMAP: Information disclosure via URLAUTH token forgery

Published Jul 16, 2026 CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Description

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)

Analysis

Technical impact

The vulnerability allows an attacker to forge a URLAUTH token in Cyrus IMAP by computing an HMAC‑SHA1 value with a predictable key. The missing mboxkey protection in versions up to 3.12.2 enables this forgery, giving the attacker read access to any mailbox whose folder name they know and for which no authentication URL has been issued, resulting in unauthorized disclosure of mailbox contents. The weakness corresponds to CWE‑340 and CWE‑341.

Affected Systems

Cyrus IMAP servers running any release through 3.12.2 are impacted. Versions 3.12.3 and later include a fix that restores the missing mboxkey check. No other vendors or products are listed as affected.

Risk and Exploitability

The CVSS score of 4.0 indicates low severity, while an EPSS score of less than 1% suggests a very low likelihood of exploitation. URLAUTH is an obscure feature, and discovery requires knowledge of a folder name that has never had an auth URL issued, further reducing risk. The vulnerability is not included in CISA's KEV catalog, and to date no public exploits have been documented.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

cyrusimap

Cyrus IMAP

unaffected

Version	Status	Constraints
`0`	affected	< 3.12.3

No data.

Vendor Product Versions

Cyrusimap

Cyrus Imap

Version	Status	Scheme	Platform
`[0,3.12.3)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Cyrus IMAP to version 3.12.3 or newer to address the missing mboxkey check.
If an upgrade cannot be performed immediately, disable the URLAUTH feature in the server configuration to eliminate the forgery vector.
Regularly review IMAP logs for anomalous URLAUTH requests or unauthorized mailbox access and investigate any suspicious activity.

Generated by OpenCVE AI on July 31, 2026 at 02:28 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4766-1	cyrus-imapd security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.297% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2026-47085
https://www.cve.org/CVERecord?id=CVE-2026-47085
https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html
https://www.cyrusimap.org/imap/download/release-notes/index.html

History

Jul 18, 2026 12:15 PM Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		cyrus-imapd: Cyrus IMAP: Information disclosure via URLAUTH token forgery
Weaknesses		CWE-341
References		https://nvd.nist.gov/vuln/detail/CVE-2026-47085 https://www.cve.org/CVERecord?id=CVE-2026-47085
Metrics	threat_severity `None`	threat_severity `Moderate`

Jul 16, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 16, 2026 6:45 PM Description updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)
First Time appeared		Cyrusimap Cyrusimap cyrus Imap
Weaknesses		CWE-340
CPEs		cpe:2.3:a:cyrusimap:cyrus_imap::::::::
Vendors & Products		Cyrusimap Cyrusimap cyrus Imap
References		https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html https://www.cyrusimap.org/imap/download/release-notes/index.html
Metrics		cvssV3_1 `{'score': 4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N'}`