Executive brief
Cyrus IMAP is a widely used mail server for managing and delivering email. A security flaw allows any logged-in user to view the access control lists (permissions) of any mailbox on the system, even those they do not own. While this does not allow them to read the actual emails, it exposes sensitive information about which users or administrators have access to specific mailboxes.
Technical details
A missing authorization check (CWE-862) in Cyrus IMAP through version 3.12.2 allows authenticated users to execute the IMAP LISTRIGHTS command against any mailbox they can name. Under normal operations, this command should be restricted to users with administrative privileges on the target mailbox. An attacker can exploit this to enumerate access control lists (ACLs) and identify which principals have what rights to specific mailboxes. This vulnerability is fixed in version 3.12.3.
Affected products
- Cyrus Cyrus IMAP Up to 3.12.2
Timeline
- 2026-07-16: disclosed
- 2026-07-16: advisory
- 2026-07-16: patched: Fixed in version 3.12.3