Description
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching the search, creating a content oracle (without allowing arbitrary reads of the target's content).
Published: 2026-07-16
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An authenticated IMAP user can send the ESEARCH command to any target account name. The server returns UIDs of messages that match the search, creating a content oracle. Although actual message bodies are not revealed, the oracle allows the attacker to enumerate which messages exist in folders of other users and, by inference, the presence of specific folders. This information exposure can aid social engineering or targeted attacks. The weakness maps to CWE-201 and CWE-204.

Affected Systems

The issue exists in the Cyrus IMAP server (cyrus-imapd) up to version 3.12.2. Versions 3.12.3 and later incorporate the fix.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate severity. The EPSS score is below 1%, meaning the likelihood of exploitation is currently very low, and the vulnerability is not listed in CISA's KEV catalog. Nevertheless, the vulnerability requires valid IMAP credentials to be exploited, so its impact depends on the organization's authentication security. In environments where users have broad access, the oracle could be used to prepare more advanced attacks.

Generated by OpenCVE AI on July 31, 2026 at 02:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Cyrus IMAP to version 3.12.3 or later.
  • Restrict the ESEARCH command to trusted users or networks.
  • Monitor IMAP logs for abnormal ESEARCH activity.

Generated by OpenCVE AI on July 31, 2026 at 02:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 18 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Title cyrus-imapd: Cyrus IMAP: Information disclosure via ESEARCH command
Weaknesses CWE-201
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 16 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 16 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
Description An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching the search, creating a content oracle (without allowing arbitrary reads of the target's content).
First Time appeared Cyrusimap
Cyrusimap cyrus Imap
Weaknesses CWE-204
CPEs cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:*
Vendors & Products Cyrusimap
Cyrusimap cyrus Imap
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Cyrusimap Cyrus Imap
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-07-16T18:51:53.806Z

Reserved: 2026-05-18T00:00:00.000Z

Link: CVE-2026-47083

cve-icon Vulnrichment

Updated: 2026-07-16T18:51:45.688Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-16T00:00:00Z

Links: CVE-2026-47083 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T02:30:05Z

Weaknesses
  • CWE-201

    Insertion of Sensitive Information Into Sent Data

  • CWE-204

    Observable Response Discrepancy