CVE-2026-47089

Name	CVE-2026-47089
Description	An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4766-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
cyrus-imapd (PTS)	bookworm	3.6.1-4+deb12u4	vulnerable
	bookworm (security)	3.6.1-4+deb12u5	fixed
	trixie	3.10.2-1+deb13u2	fixed
	forky, sid	3.12.4-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
cyrus-imapd	source	bookworm	3.6.1-4+deb12u5	DLA-4766-1
cyrus-imapd	source	trixie	3.10.2-1+deb13u2
cyrus-imapd	source	(unstable)	3.12.3-1

https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html