CVE-2026-47082: Medium severity Cyrus IMAP cyrus-imapd vulnerability
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Cyrus IMAP user who can configure a vacation Sieve script and use its :fcc option can exploit it. The user does not need insert permission on the mailbox chosen as the :fcc destination.
What is the impact of successful exploitation?
The attacker can cause copies of vacation auto-replies to be delivered into arbitrary named mailboxes. This bypasses destination-mailbox ACL enforcement and can affect mailbox integrity and availability.
Are installations affected by default?
The issue requires use of the vacation Sieve feature with the :fcc option. Systems where users do not use or cannot configure vacation Sieve scripts with :fcc are not exposed through this behavior.
What can be done before updating?
Prevent or restrict use of vacation Sieve scripts that specify :fcc destinations, particularly for untrusted users. Review existing scripts for :fcc usage and remove or change destinations that the script owner is not authorized to insert into.
How can administrators check for potential abuse?
Review users' vacation Sieve scripts for the :fcc option and identify destinations for which the script owner lacks insert permission. Check those destination mailboxes for vacation auto-reply copies that were delivered contrary to their ACLs.