CVE-2026-47083CWE-204

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2

Medium · published July 16, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
22.2
In the wild
Unconfirmed
What it is

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching the search, creating a content oracle (without allowing arbitrary reads of the target's content).

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00306 · 22.2th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2026-07-16T00:00Z
EPSS history
Timeline
  • 16 JUL 00:00Z
    An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2
    cvelistv5