Executive brief
Cyrus IMAP is a widely used email server for managing and storing user mailboxes. A security flaw in its automated vacation reply system allows an authenticated user to bypass folder permissions. This means a user could force the system to save copies of automated emails into mailboxes they should not have access to, potentially disrupting organization or filling up restricted storage areas.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the vacation "fcc" (File Carbon Copy) feature of Cyrus IMAP. When a user's Sieve script uses the :fcc argument to save a copy of an auto-reply, the server fails to validate Access Control List (ACL) permissions for the destination mailbox. An authenticated attacker can exploit this by naming any mailbox in their script, allowing them to insert messages into folders where they lack 'insert' rights. This issue is resolved in Cyrus IMAP version 3.12.3.
Affected products
- Cyrus Cyrus IMAP up to 3.12.2
Timeline
- 2026-07-16: advisory: NVD publication date
- 2026-07-16: patched: Version 3.12.3 released with fix