CVE-2026-47087

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.

View graph Watch Export

CVSS v3.1

3.5 LOW

EPSS

0.29%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

EPSS Trend

Aug 16, 2026 → Aug 26, 2026

▲ 0.09pp

0.19% → 0.29% over 2 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityHIGH

Privileges RequiredLOW

User InteractionNONE

ScopeCHANGED

ConfidentialityLOW

IntegrityNONE

AvailabilityNONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

Connections

1 relationships

CWE-672

source

Timeline

disclosure → media coverage

Jul 16, 2026

Disclosure — published as a CVE record.