CVE-2026-47086

Name	CVE-2026-47086
Description	An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4766-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
cyrus-imapd (PTS)	bookworm	3.6.1-4+deb12u4	vulnerable
	bookworm (security)	3.6.1-4+deb12u5	fixed
	trixie	3.10.2-1+deb13u2	fixed
	forky, sid	3.12.4-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
cyrus-imapd	source	bookworm	3.6.1-4+deb12u5	DLA-4766-1
cyrus-imapd	source	trixie	3.10.2-1+deb13u2
cyrus-imapd	source	(unstable)	3.12.3-1

https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html