GCVE - cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Cyrusimap (`a34f4a29-f413-5072-b6ba-547158f77224`)
Product	Cyrus Imap (`20e6216b-7d01-5f95-a198-b6a60262d502`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/cyrus-imapd`	purl2cpe	2026-06-01 10:11:16.030898
`pkg:deb/ubuntu/cyrus-imapd`	purl2cpe	2026-06-01 10:11:16.030900
`pkg:github/cyrusimap/cyrus-imapd`	purl2cpe	2026-06-01 10:11:16.030902
`pkg:rpm/fedora/cyrus-imapd`	purl2cpe	2026-06-01 10:11:16.030903
`pkg:rpm/opensuse/cyrus-imapd`	purl2cpe	2026-06-01 10:11:16.030905

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-47089`	vulnerable	2026-07-29 00:54:59.800314	Details available MEDIUM (4.3) An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.) Published: 2026-07-16T00:00:00.000Z Updated: 2026-07-16T19:01:51.550Z Open on db.gcve.eu Reference links https://www.cyrusimap.org/imap/download/release-notes/index.html https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-47088`	vulnerable	2026-07-29 00:54:59.800209	Details available LOW (3.1) An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message's end in memory, and read into the heap, returning the read content to the user. Published: 2026-07-16T00:00:00.000Z Updated: 2026-07-16T19:01:31.618Z Open on db.gcve.eu Reference links https://www.cyrusimap.org/imap/download/release-notes/index.html https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-47087`	vulnerable	2026-07-29 00:54:59.800093	Details available LOW (3.5) An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked. Published: 2026-07-16T00:00:00.000Z Updated: 2026-07-16T19:00:30.184Z Open on db.gcve.eu Reference links https://www.cyrusimap.org/imap/download/release-notes/index.html https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-47086`	vulnerable	2026-07-29 00:54:59.799875	Details available LOW (3.5) An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions. Published: 2026-07-16T00:00:00.000Z Updated: 2026-07-16T18:47:07.040Z Open on db.gcve.eu Reference links https://www.cyrusimap.org/imap/download/release-notes/index.html https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-47085`	vulnerable	2026-07-29 00:54:59.799759	Details available MEDIUM (4) An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.) Published: 2026-07-16T00:00:00.000Z Updated: 2026-07-16T18:54:53.528Z Open on db.gcve.eu Reference links https://www.cyrusimap.org/imap/download/release-notes/index.html https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-47084`	vulnerable	2026-07-29 00:54:59.799539	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-47083`	vulnerable	2026-07-29 00:54:59.799301	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-47082`	vulnerable	2026-07-29 00:54:59.799062	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-47081`	vulnerable	2026-07-29 00:54:59.798757	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-34055`	vulnerable	2026-06-08 06:37:32.567207	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-12843`	vulnerable	2026-06-08 05:08:47.948346	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.