What is the CVSS score of CVE-2026-47083?

CVE-2026-47083 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-47083?

Yes, a patch is available for CVE-2026-47083. Update the affected software to the latest version immediately.

Cyrus IMAP CVE-2026-47083

EUVD-2026-45006 MEDIUM

Observable Response Discrepancy (CWE-204)

2026-07-16 mitre

GHSA-7m4j-qx5p-343w

Information Disclosure Oracle Red Hat Suse Cyrus Imap Cyrusimap

4.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible IMAP command requiring valid credentials (PR:L); only low confidentiality impact as folder names and UIDs are exposed but message content is not readable.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 16, 2026 - 20:48 EUVD

Analysis Generated

Jul 16, 2026 - 19:01 vuln.today

DescriptionCVE.org

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching the search, creating a content oracle (without allowing arbitrary reads of the target's content).

AnalysisAI

Cross-user information disclosure in Cyrus IMAP through 3.12.2 allows any authenticated IMAP user to enumerate folder names and retrieve message UIDs belonging to arbitrary other accounts via the ESEARCH command, creating a content oracle. The flaw (CWE-204, Observable Response Discrepancy) leaks mailbox structure - including folder names that may reveal sensitive organizational or personal context - without permitting reads of actual message content. No public exploit code has been identified at time of analysis, no CISA KEV listing exists, and the CVSS score of 4.3 reflects the authentication prerequisite and limited confidentiality impact, though risk is elevated in shared multi-tenant deployments such as ISPs and universities.

Technical ContextAI

Cyrus IMAP is an open-source IMAP server developed by Carnegie Mellon University's Project Cyrus and widely deployed in academic, ISP, and enterprise environments. The vulnerability lies in the server's handling of the ESEARCH command (defined in RFC 4731 as a structured extension to standard IMAP SEARCH), which is enabled by default. CWE-204 (Observable Response Discrepancy) describes flaws where response differences reveal information an actor should not have access to - here, ESEARCH returns structured UID lists for messages matching the query, and the implementation fails to scope cross-namespace queries to only the requesting user's authorized mailboxes. The CPE string cpe:2.3:a:cyrusimap:cyrus_imap:*:*:*:*:*:*:*:* covers all versions through 3.12.2. Because IMAP namespaces allow addressing other users' mailboxes directly (e.g., user.victim), the ESEARCH oracle permits inference of folder existence and message presence across the entire server population without any grant of read access.

RemediationAI

Upgrade to Cyrus IMAP 3.12.3 or later as indicated by the vendor release notes at https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html; the general release index at https://www.cyrusimap.org/imap/download/release-notes/index.html should be consulted for fixes applicable to other supported branches. If an immediate upgrade is not feasible, administrators can reduce exposure by restricting IMAP namespace access: configuring Cyrus IMAP's namespace settings to disable cross-user namespace access (e.g., setting altnamespace and disabling the shared or other-users namespace in imapd.conf) would prevent ESEARCH from reaching other users' mailboxes, though this may break legitimate IMAP sharing and delegation workflows. Deploying an IMAP proxy layer with strict namespace enforcement is an additional option but introduces operational complexity. Disabling ESEARCH entirely is not recommended as it would broadly degrade IMAP client performance. Note that patch version 3.12.3 is inferred from the referenced URL and has not been independently confirmed via a separate security advisory.