CVE-2026-47086

A flaw was found in cyrus-imapd. An authenticated user could exploit this vulnerability by minting a URLAUTH token through the GENURLAUTH command. This allows bypassing Access Control Lists (ACLs), which are rules that control access to mailboxes. Consequently, an attacker could read mail from any mailbox, even without having been granted explicit read permissions.

This flaw in cyrus-imapd allows an authenticated attacker to bypass Access Control Lists (ACLs) by minting a URLAUTH token via the GENURLAUTH command. This enables unauthorized reading of mail from any mailbox, even without explicit read permissions, posing a significant risk to data confidentiality in Red Hat deployments utilizing the Cyrus IMAP server.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce the attack surface, restrict network access to the Cyrus IMAP server to only trusted clients and networks by configuring appropriate firewall rules. If the Cyrus IMAP service is not essential, consider disabling it. To disable the cyrus-imapd service, execute sudo systemctl stop cyrus-imapd and sudo systemctl disable cyrus-imapd. Disabling the service will prevent all mail access via IMAP and may require a system restart to fully take effect.