An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. (CVE-2026-47089)
Description
Cyrus IMAP through version 3.12.2 contains a vulnerability where the LISTRIGHTS command is not properly restricted to admin users. Authenticated users can query access rights on any mailbox they can name, potentially revealing which principals have access to that mailbox. This issue affects multiple specific versions of cyrus-imapd. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVSS v3.1
Score 4.3medium
Affected software
pkg:deb/ubuntu/cyrus-imapd?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/cyrus-imapd?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/cyrus-imapd?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/cyrus-imapd?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/cyrus-imapd?arch=source&distro=stonkingpkg:deb/ubuntu/cyrus-imapd?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
An access control vulnerability exists in cyrus-imapd in Cyrus IMAP versions through 3.12.2. The LISTRIGHTS command, which should be restricted to users with administrative access on the target mailbox, is accessible to any authenticated user. This allows an authenticated user to enumerate the access rights of principals on any mailbox they can specify, potentially leaking sensitive access control information. The vulnerability affects a range of specific cyrus-imapd package versions as listed. There is no information provided about a patch or remediation status.
Potential Impact
An authenticated user can obtain information about which principals have what access rights to any mailbox they can name. This could lead to unauthorized disclosure of access control information, which may aid in further attacks or privilege escalation attempts. There is no indication of direct data modification or denial of service impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user access to trusted users only and monitor for suspicious use of the LISTRIGHTS command if possible.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-47089
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:Pro:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad3f64c2cdf04f656665856
Added to database: 10/17/2026, 22:27:24 UTC
Last enriched: 10/18/2026, 01:23:13 UTC
Last updated: 10/18/2026, 01:23:13 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.