EUVD-2026-45006
GHSA-7m4j-qx5p-343w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible IMAP command requiring valid credentials (PR:L); only low confidentiality impact as folder names and UIDs are exposed but message content is not readable.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching the search, creating a content oracle (without allowing arbitrary reads of the target's content).
AnalysisAI
Cross-user information disclosure in Cyrus IMAP through 3.12.2 allows any authenticated IMAP user to enumerate folder names and retrieve message UIDs belonging to arbitrary other accounts via the ESEARCH command, creating a content oracle. The flaw (CWE-204, Observable Response Discrepancy) leaks mailbox structure - including folder names that may reveal sensitive organizational or personal context - without permitting reads of actual message content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid, authenticated IMAP account on the affected server (CVSS PR:L confirms this requirement). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N and score of 4.3 are well-calibrated: the attack is network-reachable with low complexity but requires a valid authenticated account (PR:L), and impact is strictly limited to low confidentiality - folder names and UIDs are disclosed, but message bodies cannot be read. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privilege authenticated account on a shared Cyrus IMAP server - such as a student on a university mail system or a customer on an ISP - issues ESEARCH commands targeting named victim accounts (e.g., user.targetname) with varied search criteria. The server returns UID lists for matching messages, confirming the existence of specific folders and the presence of messages meeting the search conditions, allowing the attacker to infer sensitive organizational structure (e.g., confirming a folder named 'legal-hold' or 'acquisition-talks' exists) without ever reading message content. … |
| Remediation | Upgrade to Cyrus IMAP 3.12.3 or later as indicated by the vendor release notes at https://www.cyrusimap.org/3.12/imap/download/release-notes/3.12/x/3.12.3.html; the general release index at https://www.cyrusimap.org/imap/download/release-notes/index.html should be consulted for fixes applicable to other supported branches. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cyrus Imap
View allCyrus IMAP before 3.0.3 allows remote authenticated users to write to arbitrary files via a crafted (1) SYNCAPPLY, (2) S
Unauthorized mailbox deletion in Cyrus IMAP through 3.12.2 allows any authenticated non-admin user to invoke the admin-o
Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation
Incorrect authorization in Cyrus IMAP through 3.12.2 allows authenticated users to bypass mailbox ACL enforcement via th
Cyrus IMAP through 3.12.2 exposes mailbox ACL data to any authenticated user via the IMAP LISTRIGHTS command, which lack
URLAUTH token forgery in Cyrus IMAP through 3.12.2 allows a network-based unauthenticated attacker to read the contents
Unauthorized mailbox access in Cyrus IMAP through 3.12.2 allows any authenticated user to read email from mailboxes they
Cyrus IMAP through version 3.12.2 fails to invalidate URLAUTH-minted URLs when the authorizer's access is subsequently r
Cyrus IMAP through version 3.12.2 contains an authorization flaw in its XAPPLEPUSHSERVICE (XAPS) command that lets authe
Heap over-read in Cyrus IMAP through version 3.12.2 enables authenticated IMAP users to leak server heap memory by submi
Same weakness CWE-204 – Observable Response Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today