An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3bf3e31ef4 advisory.

    - New version 3.12.4 (rhbz#2500822)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-97a7ec5786 advisory.

    - New version 3.10.4 (rhbz#2500822)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-740bc1c6fa advisory.

    - New version 3.12.4 (rhbz#2500822)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4766 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4766-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Xavier Guimard     September 01, 2026                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : cyrus-imapd     Version        : 3.6.1-4+deb12u5     CVE ID         : CVE-2026-47081 CVE-2026-47082 CVE-2026-47084 CVE-2026-47085                      CVE-2026-47086 CVE-2026-47087 CVE-2026-47088 CVE-2026-47089

    Several vulnerabilities were discovered in cyrus-imapd, a highly scalable     mail store with support for IMAP, JMAP, POP3, CalDAV and CardDAV. Most of     them allow authenticated users to bypass access control lists (ACL) and to     access or modify other users' mailboxes.

    CVE-2026-47081

        The XAPPLEPUSHSERVICE command allowed an authenticated user to probe         for the existence of other users' mailboxes and to hijack their push         notifications.

    CVE-2026-47082

        Delivery of the Sieve vacation fcc copy skipped the ACL check on the         destination mailbox, allowing a user to write messages into a mailbox         they have no rights on.

    CVE-2026-47084

        The LOCALDELETE command bypassed ACL checks, allowing non-admin users         to delete mailboxes they are not permitted to delete.

    CVE-2026-47085

        URLAUTH tokens could be forged because a predictable empty mboxkey was         accepted, giving unauthorized access to message content.

    CVE-2026-47086

        The GENURLAUTH command issued URLAUTH tokens without checking the         ACL_READ right on the target mailbox.

    CVE-2026-47087

        URLAUTH tokens remained valid after the access rights of the user who         issued them had been revoked.

    CVE-2026-47088

        A heap out-of-bounds read was possible when parsing nested MIME         comments in RFC 822 headers, which may lead to a denial of service.

    CVE-2026-47089

        The LISTRIGHTS command was not restricted to users having admin rights         on the target mailbox, disclosing the ACL of other users' mailboxes.

    These issues were fixed upstream in Cyrus IMAP 3.10.3 and have been     backported to the 3.6 branch, which upstream no longer supports.

    For Debian 12 bookworm, these problems have been fixed in version     3.6.1-4+deb12u5.

    We recommend that you upgrade your cyrus-imapd packages.

    For the detailed security status of cyrus-imapd please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/cyrus-imapd

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21368-1 advisory.

    Changes in cyrus-imapd:

    - Update to 3.8.7 (bugfix release)
    - CVE-2026-47081: XAPPLEPUSHSERVICE folder existence oracle and push hijack (bsc#1271617)
    - CVE-2026-47083: ESEARCH cross-user content oracle (bsc#1271619)
    - CVE-2026-47082: Vacation fcc skips destination-mailbox ACL (bsc#1271618)
    - CVE-2026-47084: LOCALDELETE bypassed ACL checks (bsc#1271620)
    - CVE-2026-47085: URLAUTH token forgery via missing mboxkey (bsc#1271621)
    - CVE-2026-47086: GENURLAUTH issued tokens bypassing ACLs (bsc#1271622)
    - CVE-2026-47087: URLAUTH does not honor revoked authorizer access (bsc#1271623)
    - CVE-2026-47088: Heap exposure in nested MIME comment parsing (bsc#1271624)
    - CVE-2026-47089: LISTRIGHTS not limited to users with admin access (bsc#1271625)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users     with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name     and learn what principals had what access to it. (This action should have been restricted to users with     admin access on the target mailbox.) (CVE-2026-47089)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
349129	Fedora 45 : cyrus-imapd (2026-3bf3e31ef4)	Nessus	Fedora Local Security Checks	Local	high
349123	Fedora 43 : cyrus-imapd (2026-97a7ec5786)	Nessus	Fedora Local Security Checks	Local	high
349116	Fedora 44 : cyrus-imapd (2026-740bc1c6fa)	Nessus	Fedora Local Security Checks	Local	high
342180	Debian dla-4766 : cyrus-admin - security update	Nessus	Debian Local Security Checks	Local	medium
327811	openSUSE 16: cyradm / cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-snmp / etc (openSUSE-SU-2026:21368-1)	Nessus	SuSE Local Security Checks	Local	medium
327545	Linux Distros Unpatched Vulnerability : CVE-2026-47089	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-47089

medium

Tenable Plugins

high

high

high

medium

medium

medium