Security Advisory
CVE-2026-47082
5.4
MEDIUM
Vulnerability Description
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user whose vacation Sieve script used :fcc (to save a copy of the sent message) could deliver vacation auto-reply copies into any mailbox the script could name, regardless of whether the script owner had insert permissions on the destination mailbox.
Published Date
July 16, 2026
Official Source
NIST NVD Advisory