CVE-2026-47087

Published: Jul 16, 2026Modified: Jul 17, 2026Deferred

3.5

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

Exploitability: 1.8 / Impact: 1.4

Source: MITRE (Secondary)

Description

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.

Related CWEs

CWE-672

Operation on a Resource after Expiration or Release

The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

References (2)

https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html

Source: cve@mitre.org

https://www.cyrusimap.org/imap/download/release-notes/index.html

Source: cve@mitre.org

Timeline

No history available yet.