CVE-2026-47085
published 2026-07-16CVE-2026-47085: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name…
PriorityP421medium4CVSS 3.1
AVNACHPRNUINSCCLINAN
EPSS
0.19%
8.6th percentile
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cyrusimap | cyrus_imap | < 3.12.3 | 3.12.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-47085 cyrus-imapd: Cyrus IMAP: Information disclosure via URLAUTH token forgery [fedora-all]
bugzilla·2026-07-17·CVSS 4.0
CVE-2026-47085 [MEDIUM] CVE-2026-47085 cyrus-imapd: Cyrus IMAP: Information disclosure via URLAUTH token forgery [fedora-all]
CVE-2026-47085 cyrus-imapd: Cyrus IMAP: Information disclosure via URLAUTH token forgery [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this a
Bugzilla
CVE-2026-47085 cyrus-imapd: Cyrus IMAP: Information disclosure via URLAUTH token forgery
bugzilla·2026-07-16·CVSS 4.0
CVE-2026-47085 [MEDIUM] CVE-2026-47085 cyrus-imapd: Cyrus IMAP: Information disclosure via URLAUTH token forgery
CVE-2026-47085 cyrus-imapd: Cyrus IMAP: Information disclosure via URLAUTH token forgery
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)
2026-07-16
Published