CVE-2026-47081

Name of the Vulnerable Software and Affected Versions cyrus-imapd versions prior to 3.12.3

Description An authenticated IMAP user can probe for the existence of arbitrary mailboxes on other users' accounts using the XAPPLEPUSHSERVICE command. This folder existence oracle allows the user to hijack push notifications by creating Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This issue does not leak mailbox content; instead, it triggers a notice that the mailbox has changed whenever the modseq changes.

Recommendations Update to a version newer than 3.12.2. As a temporary mitigation, restrict the use of the XAPPLEPUSHSERVICE command.