What is GHSA-fx86-vr4x-grgq?

GHSA-fx86-vr4x-grgq is a security advisory published by GitHub Security Advisories with Medium severity. An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to...

Which CVE IDs does GHSA-fx86-vr4x-grgq cover?

GHSA-fx86-vr4x-grgq covers the following CVE IDs: CVE-2026-47089. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fx86-vr4x-grgq?

GHSA-fx86-vr4x-grgq has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-fx86-vr4x-grgqMediumCVSS 4.3

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to...

Vendor

GitHub Security Advisories

Published

July 16, 2026

Last Modified

July 16, 2026

🔗 CVE IDs covered (1)

CVE-2026-47089 →

📋 Description

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-47089
https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html
https://www.cyrusimap.org/imap/download/release-notes/index.html
https://github.com/advisories/GHSA-fx86-vr4x-grgq