CyberRota Analysis
AI-GeneratedCyrus IMAP versions up to 3.12.2 are vulnerable due to improper access controls on the LISTRIGHTS command, allowing authenticated users to query mailbox permissions they should not have access to. This could lead to unauthorized disclosure of mailbox access rights, potentially compromising sensitive information. Organizations using these versions should prioritize patching to mitigate the risk of information leakage.
Original NVD Description
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. (This action should have been restricted to users with admin access on the target mailbox.)