CVE-2026-47081: CWE-863 Incorrect Authorization in cyrusimap Cyrus IMAP
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed.
AI Analysis
Technical Summary
The vulnerability in Cyrus IMAP (up to version 3.12.2) allows an authenticated IMAP user to leverage the XAPPLEPUSHSERVICE command as a mailbox existence oracle. The attacker can probe whether arbitrary mailboxes exist on other users' accounts and then hijack push notifications by creating Apple Push Notification Service alerts for those mailboxes to their own APNS device. This issue constitutes incorrect authorization (CWE-863) because the user can access mailbox existence information and trigger notifications without proper permission. The vulnerability does not disclose mailbox contents, only the existence and change notifications.
Potential Impact
An attacker with valid IMAP authentication can determine the existence of mailboxes belonging to other users and receive push notifications about mailbox changes. This could potentially be used to infer user activity or mailbox presence but does not expose mailbox content or allow modification. The impact is limited to information disclosure about mailbox existence and notification hijacking.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a fix is available, monitoring and restricting authenticated IMAP access to trusted users may reduce risk.
CVE-2026-47081: CWE-863 Incorrect Authorization in cyrusimap Cyrus IMAP
Description
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed.
CVSS v3.1
Score 3.1low
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Cyrus IMAP (up to version 3.12.2) allows an authenticated IMAP user to leverage the XAPPLEPUSHSERVICE command as a mailbox existence oracle. The attacker can probe whether arbitrary mailboxes exist on other users' accounts and then hijack push notifications by creating Apple Push Notification Service alerts for those mailboxes to their own APNS device. This issue constitutes incorrect authorization (CWE-863) because the user can access mailbox existence information and trigger notifications without proper permission. The vulnerability does not disclose mailbox contents, only the existence and change notifications.
Potential Impact
An attacker with valid IMAP authentication can determine the existence of mailboxes belonging to other users and receive push notifications about mailbox changes. This could potentially be used to infer user activity or mailbox presence but does not expose mailbox content or allow modification. The impact is limited to information disclosure about mailbox existence and notification hijacking.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a fix is available, monitoring and restricting authenticated IMAP access to trusted users may reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-05-18T00:00:00.000Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a59206068715ace437c3f15
Added to database: 07/16/2026, 18:18:08 UTC
Last enriched: 07/16/2026, 18:33:11 UTC
Last updated: 07/16/2026, 21:01:05 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.