An authenticated user can issue the GENURLAUTH command to generate a URLAUTH token for any mailbox name, even if the user lacks read permission on that mailbox. The token then authorizes access to the mailbox via the HTTP token interface, allowing the user to read email messages that should be protected. This privilege escalation bypasses the intended access control model and is classified as a CWE-863 authorization bypass and a CWE-639 authorization bypass through user‑controlled key.

The vulnerability is present in all releases of the Cyrus IMAP. 3.12.3 indicates the issue has been fixed. Therefore, all installations running 3.12.2 or earlier are affected.

The CVSS score of 3.5 denotes a low severity, and the EPSS score of less than 1% suggests exploitation is unlikely, especially because the attack requires only a valid account on the server. The vulnerability is not listed in the CISA KEV catalog. Nevertheless, because authenticated users can gain read access to arbitrary mailbox data, the attack could expose sensitive personal or business information. An attacker only needs to authenticate, issue GENURLAUTH for a targeted mailbox, and use the returned token to retrieve data, making the exploit straightforward in environments where accounts exist. Therefore, the risk is low to moderate, and remediation should still be performed promptly.