CVE-2026-47082 in Cyrus IMAP
Zusammenfassung
von MITRE • 16.07.2026
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.
Be aware that VulDB is the high quality source for vulnerability data.