CVE-2026-47084

A flaw was found in Cyrus IMAP (cyrus-imapd). An authenticated user, without administrative privileges, could bypass Access Control List (ACL) checks by using the LOCALDELETE command. This allowed them to delete mailboxes for which they did not have the necessary permissions, leading to unauthorized data integrity compromise.

This Moderate flaw in Cyrus IMAP allows an authenticated user to bypass Access Control List (ACL) restrictions, enabling unauthorized mailbox deletion. The impact is considered Moderate as it requires prior authentication and specific command usage, limiting exploitation to existing users.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.