Cyrus IMAP EUVD-2026-75129

Exploitation requires a valid authenticated user account on the Cyrus IMAP server (CVSS PR:L confirmed). The user must have permission to install Sieve scripts (the sieve capability must be enabled, which is commonly on by default in Cyrus deployments). The side-channel fires only during LMTP delivery - the attacker must trigger a mail delivery event to their own account after installing the probing script. The attack reveals only: (1) binary existence of another user's private mailbox by name, and (2) the value of shared mailbox annotations - it does not expose message content, credentials, or any writeable resource. Exploitation is limited to authenticated insiders or compromised accounts; unauthenticated remote attackers cannot exploit this.

The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately captures the attack profile: network-reachable, low complexity, but requiring a valid user credential (PR:L). Real-world risk is bounded by the information disclosure-only impact - an attacker learns which private mailboxes exist or reads annotation strings, but cannot read mail content, write data, or disrupt service. This is primarily an insider-threat or tenant-isolation concern in multi-user or hosted IMAP environments (e.g., universities, shared mail hosting). No KEV listing, no known POC, and no EPSS data are provided, consistent with a low exploitation probability. The issue is meaningful in environments with strict mailbox privacy requirements (legal hold, confidential project mailboxes), but poses negligible risk to standard single-tenant deployments. No conflicting signals are present between CVSS and the description.

An authenticated IMAP user (e.g., a malicious tenant or compromised account on a shared hosting platform) composes a Sieve script containing fileinto actions conditioned on whether a target mailbox (e.g., 'user/victim/Confidential') exists. After installing the script, the attacker sends a test message to themselves, then observes which delivery branch fired - revealing whether the target private mailbox exists. Repeating this for annotation values allows reading shared mailbox metadata not otherwise accessible. No public POC is known, but the technique is straightforwardly derivable from the description.