CVE-2026-47085 | An issue was discovered in cyrus-imapd in Cyrus IMAP through… | CVSS 4.0 MEDIUM

Description

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)

Metadata

CVE ID: CVE-2026-47085
State: PUBLISHED
Assigner: mitre
Reserved: 2026-05-18 00:00 UTC
Published: 2026-07-16 00:00 UTC
Last updated: 2026-07-16 18:54 UTC
Primary CWE: CWE-340
CWE-340 Generation of Predictable Numbers or Identifiers
Vendor / Product: cyrusimap / Cyrus IMAP
Sources: cve.org · NVD

Severity & Metrics

4.0 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
cyrusimap	Cyrus IMAP	—	0 < 3.12.3

Weakness (CWE)

CWE	Source	Description
CWE-340	cna	CWE-340 Generation of Predictable Numbers or Identifiers

CVSS scores (1)

Score	Severity	Version	Source	Vector
4.0	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

References (2)