CVE Feed

    Dashboard / CVE / CVE-2026-47081

    CVE-2026-47081

    An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed.

    Published:Jul 16, 2026
    Last Modified:Jul 16, 2026
    EPS:Jul 16, 2026
    EPSS Score:0.00154
    CVSS Score:3.1

    Affected Products

    Vendor
    Cyrusimap
    Product
    Cyrus Imap

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-170 Web Application Fingerprinting
    CAPEC-694 System Location Discovery

    Related CVEs

    CVE-2026-61910 (CVSS 3.5) — An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on sha…
    CVE-2026-61907 (CVSS 4.3) — An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An auth…
    CVE-2026-61909 (CVSS 3.5) — An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authe…
    CVE-2026-61908 (CVSS 3.1) — An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bound…
    CVE-2026-61911 (CVSS 4.3) — An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticat…
    CVE-2026-61915 (CVSS 4.2) — An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated c…
    CVE-2026-47087 (CVSS 3.5) — An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer…
    CVE-2026-47088 (CVSS 3.1) — An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME com…
    CVE-2026-47086 (CVSS 3.5) — An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs.…
    CVE-2026-47089 (CVSS 4.3) — An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with a…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High