Executive brief
Cyrus IMAP is a widely used mail server that handles email storage and retrieval. A security flaw in its Apple Push Notification integration allows an authorized user to determine if specific private mailboxes exist on other users' accounts. Additionally, an attacker can redirect "new mail" notifications from another person's mailbox to their own device, though they cannot read the actual content of the emails.
Technical details
An authorization bypass (CWE-863) exists in the XAPPLEPUSHSERVICE command of cyrus-imapd through version 3.12.2. An authenticated IMAP user can use this command as an existence oracle to probe for arbitrary mailbox names on other users' accounts. Furthermore, the attacker can register their own Apple Push Notification Service (APNS) device to receive notifications for those mailboxes. While the exploit does not allow the attacker to read email content, it leaks metadata regarding mailbox existence and activity (via modseq changes). The issue is resolved in Cyrus IMAP 3.12.3.
Affected products
- Cyrus IMAP Cyrus IMAP through 3.12.2
Timeline
- 2026-07-16: advisory
- 2026-07-16: disclosed
- 2026-07-16: patched: Fixed in version 3.12.3