CVE-2026-47082: Medium severity Cyrus IMAP cyrus-imapd vulnerability

Q: Who can exploit this issue?

An authenticated Cyrus IMAP user who can configure a vacation Sieve script and use its :fcc option can exploit it. The user does not need insert permission on the mailbox chosen as the :fcc destination.

Q: What is the impact of successful exploitation?

The attacker can cause copies of vacation auto-replies to be delivered into arbitrary named mailboxes. This bypasses destination-mailbox ACL enforcement and can affect mailbox integrity and availability.

Q: Are installations affected by default?

The issue requires use of the vacation Sieve feature with the :fcc option. Systems where users do not use or cannot configure vacation Sieve scripts with :fcc are not exposed through this behavior.

Q: What can be done before updating?

Prevent or restrict use of vacation Sieve scripts that specify :fcc destinations, particularly for untrusted users. Review existing scripts for :fcc usage and remove or change destinations that the script owner is not authorized to insert into.

Q: How can administrators check for potential abuse?

Review users' vacation Sieve scripts for the :fcc option and identify destinations for which the script owner lacks insert permission. Check those destination mailboxes for vacation auto-reply copies that were delivered contrary to their ACLs.

Published Jul 16, 2026

Updated

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.

Affected Software

1 affected component

Cyrus IMAP cyrus-imapd<=3.12.2

Event History

Jul 16, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Cyrus IMAP user who can configure a vacation Sieve script and use its :fcc option can exploit it. The user does not need insert permission on the mailbox chosen as the :fcc destination.

What is the impact of successful exploitation?

The attacker can cause copies of vacation auto-replies to be delivered into arbitrary named mailboxes. This bypasses destination-mailbox ACL enforcement and can affect mailbox integrity and availability.

Are installations affected by default?

The issue requires use of the vacation Sieve feature with the :fcc option. Systems where users do not use or cannot configure vacation Sieve scripts with :fcc are not exposed through this behavior.

What can be done before updating?

Prevent or restrict use of vacation Sieve scripts that specify :fcc destinations, particularly for untrusted users. Review existing scripts for :fcc usage and remove or change destinations that the script owner is not authorized to insert into.

How can administrators check for potential abuse?

Review users' vacation Sieve scripts for the :fcc option and identify destinations for which the script owner lacks insert permission. Check those destination mailboxes for vacation auto-reply copies that were delivered contrary to their ACLs.

CVE-2026-47082: Medium severity Cyrus IMAP cyrus-imapd vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Are installations affected by default?

What can be done before updating?

How can administrators check for potential abuse?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact of successful exploitation?

Are installations affected by default?

What can be done before updating?

How can administrators check for potential abuse?