CVE-2026-47083 | An issue was discovered in cyrus-imapd in Cyrus IMAP through… | CVSS 4.3 MEDIUM

Description

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching the search, creating a content oracle (without allowing arbitrary reads of the target's content).

Metadata

CVE ID: CVE-2026-47083
State: PUBLISHED
Assigner: mitre
Reserved: 2026-05-18 00:00 UTC
Published: 2026-07-16 00:00 UTC
Last updated: 2026-07-16 18:51 UTC
Primary CWE: CWE-204
CWE-204 Observable Response Discrepancy
Vendor / Product: cyrusimap / Cyrus IMAP
Sources: cve.org · NVD

Severity & Metrics

4.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
cyrusimap	Cyrus IMAP	—	0 < 3.12.3

Weakness (CWE)

CWE	Source	Description
CWE-204	cna	CWE-204 Observable Response Discrepancy

CVSS scores (1)

Score	Severity	Version	Source	Vector
4.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References (2)