Bug 2501453 (CVE-2026-47081)
| Summary: | CVE-2026-47081 cyrus-imapd: Cyrus IMAP: Information disclosure of mailbox existence via XAPPLEPUSHSERVICE command | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | rhel-process-autobot, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Cyrus IMAP (cyrus-imapd). An authenticated user could exploit this vulnerability by using the XAPPLEPUSHSERVICE command to determine if specific mailboxes exist on other users' accounts. This could allow the attacker to create Apple Push Notification Service (APNS) notifications for these mailboxes, causing a "mailbox has changed" notice to be pushed to their own device when the mailbox is updated. While no content is leaked, this constitutes an information disclosure regarding the existence and activity of other users' mailboxes.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2501664 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-07-16 19:01:45 UTC
|