CVE-2026-47081
Possible ATT&CK Techniques 2AI
T1528 · Steal Application Access Token T1135 · Network Share DiscoveryAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| cyrusimap | Cyrus IMAP | < 3.12.3 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-47081
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不正确
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| cyrusimap | Cyrus IMAP | 0 ~ 3.12.3 | - |
II. Public POCs for CVE-2026-47081
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47081
请登录查看更多情报信息。
Vendor Pages for CVE-2026-47081 (2)
Same Patch Batch · cyrusimap · 2026-07-16 · 9 CVEs total
| CVE-2026-47084 | 6.5 MEDIUM | Cyrus IMAP <3.12.2 LOCALDELETE绕过ACL漏洞 |
| CVE-2026-47082 | 5.4 MEDIUM | Cyrus IMAP 3.12.2前 ACL绕过漏洞 |
| CVE-2026-47083 | 4.3 MEDIUM | Cyrus IMAP 3.12.2 信息泄露漏洞 |
| CVE-2026-47089 | 4.3 MEDIUM | Cyrus IMAP 3.12.2及之前版本存在权限绕过漏洞 |
| CVE-2026-47085 | 4.0 MEDIUM | cyrus-imapd 3.12.2及之前版本URLAUTH令牌伪造漏洞 |
| CVE-2026-47086 | 3.5 LOW | Cyrus IMAP ACL权限绕过漏洞 |
| CVE-2026-47087 | 3.5 LOW | Cyrus IMAP 3.12.2及以下版本URLAUTH越权漏洞 |
| CVE-2026-47088 | 3.1 LOW | Cyrus IMAP 3.12.2及之前版本堆越界读取漏洞 |
IV. Related Vulnerabilities
Same weakness: CWE-863
- CVE-2026-62231
Grav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator - CVE-2026-62228
OpenClaw < 2026.6.5 Authorization Bypass via Node Exec Appro - CVE-2026-62225
OpenClaw < 2026.5.18 Authorization Bypass via Skill Command - CVE-2026-62223
OpenClaw < 2026.5.18 Authorization Bypass via Device-pair - CVE-2026-62221
OpenClaw 2026.5.12 < 2026.5.26 Authorization Bypass via allo
V. Comments for CVE-2026-47081
No comments yet