Executive brief
Cyrus IMAP is a mail server used to manage and store email for organizations. A security flaw was found where the system fails to properly cancel access to specific emails after a user's permissions have been revoked. This means that if a temporary access link was created while a user had permission, that link remains active and usable even after the administrator has removed that user's access rights.
Technical details
A vulnerability in the URLAUTH implementation of Cyrus IMAP (through version 3.12.2) results in a failure to validate the current authorization status of a principal when a previously 'minted' URLAUTH token is used. Specifically, the system does not check if the authorizer's access has been revoked since the token was generated. An authenticated attacker with prior legitimate access can exploit this to maintain persistent read access to mailboxes even after their formal permissions are withdrawn. This is classified as CWE-672 (Operation on a Resource after Expiration or Release). The issue is resolved in version 3.12.3.
Affected products
- Cyrus Cyrus IMAP through 3.12.2
Timeline
- 2026-07-16: disclosed
- 2026-07-16: advisory
- 2026-07-16: patched: Fixed in version 3.12.3