CVE-2026-47089 describes a missing authorization vulnerability (CWE-862) in Cyrus IMAP versions up to 3.12.2. The IMAP LISTRIGHTS command, which reveals access rights of principals on a mailbox, is accessible to any authenticated user regardless of admin privileges. This allows an attacker with valid credentials to enumerate access permissions on arbitrary mailboxes by invoking LISTRIGHTS with mailbox names they specify. The vulnerability does not impact confidentiality of mailbox contents directly but leaks authorization information that should be restricted. No vendor advisory or patch information is currently available.

An authenticated user can obtain information about which principals have access rights to any mailbox by using the LISTRIGHTS command without proper authorization checks. This leads to unauthorized disclosure of access control information, potentially aiding further attacks or reconnaissance. There is no indication of impact on mailbox content confidentiality, integrity, or availability. The CVSS score is 4.3 (medium), reflecting limited confidentiality impact and low complexity of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users carefully and monitor for unusual LISTRIGHTS command usage if possible. No official fix or temporary workaround is documented at this time.