Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.5
CVE-2026-47087: Cyrus IMAP: Unauthorized access to revoked URLs
CVE-2026-47087 · published 3 months ago
Summary
A bug in Cyrus IMAP software allows unauthorized access to URLs that were previously restricted. This could lead to sensitive information being accessed by users who no longer have permission. To protect your system, update to the latest version of Cyrus IMAP or apply the recommended fix.
What to do
- Update debian cyrus-imapd to version 3.12.3-1.
- Update cyrusimap cyrus imap to version 3.12.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:14 | debian | cyrus-imapd |
< 3.12.3-1 Fix: upgrade to 3.12.3-1
|
| – | cyrusimap | cyrus imap | < 3.12.3 |
| Ubuntu:Pro:18.04:LTS | canonical | cyrus-imapd | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | cyrus-imapd | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | cyrus-imapd | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | cyrus-imapd | All versions |
| Ubuntu:26.04:LTS | canonical | cyrus-imapd | All versions |
| Debian:11 | debian | cyrus-imapd | All versions |
| Debian:12 | debian | cyrus-imapd | All versions |
| Debian:13 | debian | cyrus-imapd | All versions |
Original advisory text
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after t...
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.
References
- https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html
- https://www.cyrusimap.org/imap/download/release-notes/index.html
- https://security-tracker.debian.org/tracker/CVE-2026-47087 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-47087 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-47087 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-672Operation on a Resource after Expiration or Release
Timeline
Published16 Jul 2026
Updated3 Nov 2026
First seen16 Jul 2026
Sources
CVE-2026-47087 · NVD
CVE-2026-47087 · MITRE
UBUNTU-CVE-2026-47087 · OSV
DEBIAN-CVE-2026-47087 · OSV
Track software like this
Free during beta