Vulnerability · Published Jul 16, 2026 · Assigned by mitre
CVE-2026-47085
Medium 4.0
In plain English
A medium-severity security flaw in Cyrus IMAP from cyrusimap. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | cyrus-imapd | 3.6.1-4+deb12u5 | DEBIAN-CVE-2026-47085 |
| Debian:13 | cyrus-imapd | 3.10.2-1+deb13u2 | DEBIAN-CVE-2026-47085 |
| Debian:14 | cyrus-imapd | 3.12.3-1 | DEBIAN-CVE-2026-47085 |
| Ubuntu:26.04:LTS | cyrus-imapd | no fix listed | UBUNTU-CVE-2026-47085 |
| Ubuntu:26.10 | cyrus-imapd | no fix listed | UBUNTU-CVE-2026-47085 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| cyrusimap | Cyrus IMAP | 0 – before 3.12.3 |
Weakness: CWE-340 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N