CVE-2026-47086 describes an incorrect authorization issue (CWE-863) in Cyrus IMAP versions up to 3.12.2. The flaw allows any authenticated user to mint URLAUTH tokens using the GENURLAUTH command for arbitrary mailbox names, even if they lack read access to those mailboxes. This bypasses ACL protections and permits unauthorized reading of mailbox contents. The vulnerability has a CVSS 3.1 base score of 3.5, indicating low severity, with attack vector network, high attack complexity, low privileges required, no user interaction, and limited confidentiality impact. No official patch or remediation has been documented in the provided data.

An attacker with valid authentication credentials can bypass mailbox ACLs by generating URLAUTH tokens for mailboxes they do not have permission to access. This allows unauthorized reading of mailbox contents, compromising confidentiality. There is no indication of impact on integrity or availability. The low CVSS score reflects the requirement for authentication and high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions carefully and monitor for suspicious use of the GENURLAUTH command. No official remediation or temporary fix is documented in the provided information.