CVE-2026-47089CWE-862

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2

Medium · published July 16, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
19.5
In the wild
Unconfirmed
What it is

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00281 · 19.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-07-16T00:00Z
EPSS history
Timeline
  • 16 JUL 00:00Z
    An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2
    cvelistv5