CVE-2026-47087: CWE-672 Operation on a Resource after Expiration or Release in cyrusimap Cyrus IMAP
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
AI Analysis
Technical Summary
CVE-2026-47087 affects Cyrus IMAP versions up to 3.12.2. The issue involves URLAUTH URLs that do not respect revocation of authorizer access. Specifically, a URLAUTH URL minted while the authorizer had access remains valid and usable even after that access is revoked. This constitutes an operation on a resource after its authorization has expired or been released, categorized as CWE-672. The vulnerability has a low CVSS score of 3.5, reflecting limited impact primarily to confidentiality with no integrity or availability impact. No official fix or patch has been documented at this time.
Potential Impact
An attacker or user with a previously authorized URLAUTH URL can continue to access resources even after their authorizer's access has been revoked. This leads to a confidentiality impact as unauthorized access to resources may persist. There is no impact on integrity or availability. The attack complexity is high and requires network access with low privileges, and no user interaction is needed.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider revoking or invalidating URLAUTH URLs manually if possible or restrict their use. Monitoring and controlling URLAUTH URL issuance and usage may help reduce risk. No official remediation or temporary fix has been published by the vendor as of now.
CVE-2026-47087: CWE-672 Operation on a Resource after Expiration or Release in cyrusimap Cyrus IMAP
Description
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
CVSS v3.1
Score 3.5low
Affected software
pkg:github/cyrusimap/cyrus-imapRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-47087 affects Cyrus IMAP versions up to 3.12.2. The issue involves URLAUTH URLs that do not respect revocation of authorizer access. Specifically, a URLAUTH URL minted while the authorizer had access remains valid and usable even after that access is revoked. This constitutes an operation on a resource after its authorization has expired or been released, categorized as CWE-672. The vulnerability has a low CVSS score of 3.5, reflecting limited impact primarily to confidentiality with no integrity or availability impact. No official fix or patch has been documented at this time.
Potential Impact
An attacker or user with a previously authorized URLAUTH URL can continue to access resources even after their authorizer's access has been revoked. This leads to a confidentiality impact as unauthorized access to resources may persist. There is no impact on integrity or availability. The attack complexity is high and requires network access with low privileges, and no user interaction is needed.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider revoking or invalidating URLAUTH URLs manually if possible or restrict their use. Monitoring and controlling URLAUTH URL issuance and usage may help reduce risk. No official remediation or temporary fix has been published by the vendor as of now.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-05-18T00:00:00.000Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a59276968715ace438892c3
Added to database: 07/16/2026, 18:48:09 UTC
Last enriched: 07/16/2026, 19:03:09 UTC
Last updated: 07/16/2026, 19:18:27 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.