CVE-2026-47083
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
An issue was discovered in cyrus-imapd up to version 3.12.2 in the ESEARCH command. An authenticated IMAP user can enumerate folder names in any account they can name, leading to information disclosure about the mailbox structure.
Risk Assessment
An attacker can learn the folder names of a victim, potentially revealing sensitive organizational information (e.g., project or department names) and facilitating further social engineering attacks.
Recommendation
Immediately upgrade cyrus-imapd to version 3.12.3 or later, which includes a fix for this vulnerability.
Other vulnerabilities in cyrus-imapd
See all- CVE-2026-47085Medium
An issue in cyrus-imapd up to version 3.12.2 allows URLAUTH token forgery. An attacker who knows a victim's folder name for which no auth URL was ever issued can compute a valid HMAC-SHA1 token with a predictable key, gaining read access to the mailbox.
- CVE-2026-47081Low
In cyrus-imapd up to version 3.12.2, a vulnerability was found in the XAPPLEPUSHSERVICE command. An authenticated IMAP user can probe for the existence of arbitrary mailboxes on other users' accounts and hijack push notifications for new mail in those mailboxes to their own APNS device.
Original NVD description (English source)
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching the search, creating a content oracle (without allowing arbitrary reads of the target's content).