CVE-2026-47081

cyrus-imapd: Cyrus IMAP: Information disclosure of mailbox existence via XAPPLEPUSHSERVICE command

Loading…

Severity

Low

Red Hat Product Security

3.1

CVSS 3.1

Review impact separately from score.

Published · July 16, 2026

Updated · July 17, 2026

Description

A flaw was found in Cyrus IMAP (cyrus-imapd). An authenticated user could exploit this vulnerability by using the XAPPLEPUSHSERVICE command to determine if specific mailboxes exist on other users' accounts. This could allow the attacker to create Apple Push Notification Service (APNS) notifications for these mailboxes, causing a "mailbox has changed" notice to be pushed to their own device when the mailbox is updated. While no content is leaked, this constitutes an information disclosure regarding the existence and activity of other users' mailboxes.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere