CVE-2026-47085: Medium severity Cyrus cyrus-imapd vulnerability
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47085?
CVE-2026-47085 has a medium severity rating of 4.
What is the risk associated with CVE-2026-47085?
CVE-2026-47085 carries a risk score of 23.
How can I fix CVE-2026-47085?
To mitigate CVE-2026-47085, ensure you update to the latest version of Cyrus IMAP that addresses this vulnerability.
What type of issue is CVE-2026-47085?
CVE-2026-47085 is a URLAUTH token forgery issue caused by a missing mboxkey in Cyrus IMAP.
Who is affected by CVE-2026-47085?
CVE-2026-47085 affects users of cyrus-imapd versions up to and including 3.12.2.