An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. (CVE-2026-47085)

CVE-2026-47085 describes a vulnerability in cyrus-imapd in Cyrus IMAP versions through 3.12.2. The flaw involves URLAUTH token forgery caused by a missing mailbox key (mboxkey). An attacker with knowledge of a folder name on a victim's account, where no prior auth URL was issued, can generate a valid URLAUTH token by computing an HMAC-SHA1 with a predictable key. This enables unauthorized read access to the mailbox. The URLAUTH feature is rarely used, so the likelihood of exploitation is low.

The vulnerability allows an attacker to gain unauthorized read access to mailbox contents by forging URLAUTH tokens. However, since URLAUTH is an obscure feature and likely unused by most clients, the actual impact is limited to scenarios where URLAUTH is enabled and used. There is no impact on integrity or availability, and no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor advisories for updates. Given the low likelihood of exploitation due to the obscurity of URLAUTH, no immediate action may be required unless URLAUTH is actively used in the environment.