CVE-2026-47087
cyrus-imapd: Cyrus IMAP: Unauthorized access due to URLAUTH not honoring revoked authorizer access
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · July 16, 2026
Updated · August 7, 2026
Description
A flaw was found in Cyrus IMAP. The URLAUTH mechanism in Cyrus IMAP through version 3.12.2 does not properly revoke access for an authorizer. This allows a previously authorized user to retain access via a URLAUTH URL, even after their authorization has been revoked, potentially leading to unauthorized information disclosure.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 3.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
CWE-613 · Insufficient Session Expiration