CVE-2026-47084

MEDIUM 6.5

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An authenticated but non-admin user could invoke the admin-only LOCALDELETE IMAP command and delete mailboxes for which they had no permissions.

CWE	CWE-863
Vendor	cyrusimap
Product	cyrus imap
Published	Jul 16, 2026
Last Updated	Jul 16, 2026

Stay Ahead of the Next One

Get instant alerts for cyrusimap cyrus imap

Be the first to know when new medium vulnerabilities affecting cyrusimap cyrus imap are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

cyrusimap / Cyrus IMAP

0 < 3.12.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cyrusimap.org: https://www.cyrusimap.org/imap/download/release-notes/index.html cyrusimap.org: https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html