Description
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)
Published: 2026-07-16
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw lies in the IMAP LISTRIGHTS command, which should only be used by administrators on a mailbox; in affected versions any authenticated user could invoke LISTRIGHTS for any mailbox name they could supply, learning which principals had what level of access and representing an authorization bypass classified as CWE-266 and CWE-862.

Affected Systems

The vulnerability existed in Cyrus IMAP up through release 3.12.2; users running 3.12.0 to 3.12.2 are impacted, and the issue was fixed in 3.12.3, so servers still on 3.12.2 or earlier remain susceptible.

Risk and Exploitability

The CVSS score of 4.3 indicates low‑to‑moderate severity, and an EPSS of <1% implies a very low exploitation probability; because the flaw requires an authenticated account, an attacker who compromises a user credential can easily retrieve additional mailbox permission information; the vulnerability is not listed in CISA’s KEV catalog and no public exploits have been documented, so overall risk is moderate, weighed against the low exploitation likelihood but the potential to expose internal access hierarchies.

Generated by OpenCVE AI on August 1, 2026 at 08:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Cyrus IMAP to version 3.12.3 or newer, which restores proper access checks on LISTRIGHTS.
  • If an upgrade cannot be performed immediately, reconfigure the server to deny LISTRIGHTS to non‑administrator accounts, ensuring the command is only executable by privileged users.
  • Audit mailbox permissions to confirm that no unintended principals are exposed through LISTRIGHTS usage.

Generated by OpenCVE AI on August 1, 2026 at 08:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 18 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Title cyrus-imapd: Cyrus IMAP: Information disclosure via LISTRIGHTS
Weaknesses CWE-266
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 16 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 16 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
Description An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)
First Time appeared Cyrusimap
Cyrusimap cyrus Imap
Weaknesses CWE-862
CPEs cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:*
Vendors & Products Cyrusimap
Cyrusimap cyrus Imap
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Cyrusimap Cyrus Imap
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-07-16T19:01:51.550Z

Reserved: 2026-05-18T00:00:00.000Z

Link: CVE-2026-47089

cve-icon Vulnrichment

Updated: 2026-07-16T19:01:45.753Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-16T00:00:00Z

Links: CVE-2026-47089 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T09:00:04Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-862

    Missing Authorization