CVE-2026-47085

Name of the Vulnerable Software and Affected Versions Cyrus IMAP versions prior to 3.12.3

Description An issue exists in cyrus-imapd where URLAUTH token forgery is possible due to a missing mboxkey. An attacker who knows a folder name on a victim's account that has no existing auth URL can forge a valid URLAUTH token by calculating an HMAC-SHA1 value using a predictable key. This allows unauthorized read access to the mailbox. URLAUTH is a specialized feature with limited adoption among public clients.

Recommendations Update Cyrus IMAP to version 3.12.3 or later.