CVE-2026-47089

A flaw was found in Cyrus IMAP (cyrus-imapd). An authenticated user can exploit this vulnerability by using the IMAP LISTRIGHTS command. This allows the user to learn the access permissions of any mailbox they can name, which should be restricted to administrators. This leads to unauthorized information disclosure regarding mailbox access controls.

This Moderate-impact information disclosure flaw in Cyrus IMAP allows an authenticated user to enumerate mailbox access rights via the LISTRIGHTS command. While requiring prior authentication, this bypasses intended administrative restrictions, potentially exposing sensitive access control configurations within a Red Hat deployment. The impact is limited to information disclosure and does not grant further privileges or data modification.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict network access to the Cyrus IMAP service to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the IMAP port (typically 143 for IMAP and 993 for IMAPS) on the server hosting cyrus-imapd. Additionally, ensure that only necessary users have authenticated access to the IMAP server.