Cyrus IMAP EUVD-2026-45006

The attacker must hold a valid, authenticated IMAP account on the affected server (CVSS PR:L confirms this requirement). The ESEARCH IMAP extension must be available - it is enabled by default in Cyrus IMAP and no special configuration is required to activate it. The attack succeeds against any Cyrus IMAP version through 3.12.2 without requiring any non-default configuration. The attacker must be able to name the target account (e.g., know a victim's username or enumerate usernames via another method), but does not require any cooperation or interaction from the victim. What limits exploitation: authentication is mandatory (no unauthenticated path); only folder names and message UIDs are exposed, not message content; and in single-tenant deployments where all users are peers, the privacy impact is minimal. Meaningful exploitation is realistically constrained to multi-tenant environments where account isolation is an expected security property.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N and score of 4.3 are well-calibrated: the attack is network-reachable with low complexity but requires a valid authenticated account (PR:L), and impact is strictly limited to low confidentiality - folder names and UIDs are disclosed, but message bodies cannot be read. No EPSS score was provided in the input data, preventing quantitative exploitation probability assessment. The absence of both a CISA KEV listing and any known public POC indicates no public exploit has been identified at time of analysis. Real-world risk varies significantly by deployment context: in shared multi-tenant environments (universities, ISPs, or hosted email providers), this flaw enables meaningful privacy violations as attackers could map the mailbox structure of targeted individuals or organizations. In single-tenant or internal corporate deployments where all IMAP users are already peers, the incremental risk is substantially lower. No conflicting signals exist between the CVSS vector and the description - authentication requirement and limited impact are consistently represented.

An attacker with a low-privilege authenticated account on a shared Cyrus IMAP server - such as a student on a university mail system or a customer on an ISP - issues ESEARCH commands targeting named victim accounts (e.g., user.targetname) with varied search criteria. The server returns UID lists for matching messages, confirming the existence of specific folders and the presence of messages meeting the search conditions, allowing the attacker to infer sensitive organizational structure (e.g., confirming a folder named 'legal-hold' or 'acquisition-talks' exists) without ever reading message content. No public POC has been identified at time of analysis.