CVE-2026-47085
published 2026-07-16CVE-2026-47085: An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name…
PriorityP421medium4CVSS 3.1
AVNACHPRNUINSCCLINAN
EPSS
0.30%
22.1th percentile
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cyrusimap | cyrus_imap | < 3.12.3 | 3.12.3 |
| debian | cyrus-imapd | — | — |
CVSS provenance
nvdv3.14.0MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
vendor_redhat4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2.
ghsa_unreviewed·2026-07-16
CVE-2026-47085 [MEDIUM] CWE-340 An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2.
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)
Red Hat
cyrus-imapd: Cyrus IMAP: Information disclosure via URLAUTH token forgery
vendor_redhat·2026-07-16·CVSS 4.0
CVE-2026-47085 [MEDIUM] CWE-341 cyrus-imapd: Cyrus IMAP: Information disclosure via URLAUTH token forgery
cyrus-imapd: Cyrus IMAP: Information disclosure via URLAUTH token forgery
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)
A flaw was found in Cyrus IMAP (cyrus-imapd). A remote attacker could exploit a vulnerability related to URLAUTH token forgery, caused by a missing mailbox key. This could allow the attacker t
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-47085 cyrus-imapd: Cyrus IMAP: Information disclosure via URLAUTH token forgery [fedora-all]
bugzilla·2026-07-17·CVSS 4.0
CVE-2026-47085 [MEDIUM] CVE-2026-47085 cyrus-imapd: Cyrus IMAP: Information disclosure via URLAUTH token forgery [fedora-all]
CVE-2026-47085 cyrus-imapd: Cyrus IMAP: Information disclosure via URLAUTH token forgery [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this a
Bugzilla
CVE-2026-47085 cyrus-imapd: Cyrus IMAP: Information disclosure via URLAUTH token forgery
bugzilla·2026-07-16·CVSS 4.0
CVE-2026-47085 [MEDIUM] CVE-2026-47085 cyrus-imapd: Cyrus IMAP: Information disclosure via URLAUTH token forgery
CVE-2026-47085 cyrus-imapd: Cyrus IMAP: Information disclosure via URLAUTH token forgery
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)
2026-07-16
Published