Executive brief
Cyrus IMAP is a widely used mail server that handles email storage and retrieval. A vulnerability in the search functionality allows an authenticated user to discover the names of folders belonging to other users and determine if specific messages exist within them. While this does not allow the attacker to read the full content of the emails, it results in a privacy breach by exposing sensitive folder structures and message metadata across different accounts.
Technical details
An issue in the ESEARCH command implementation in Cyrus IMAP through version 3.12.2 creates a cross-user content oracle. An authenticated IMAP user can leverage the ESEARCH command to enumerate folder names under any account they can identify. Furthermore, the search returns UIDs of messages that match specific search criteria, allowing an attacker to confirm the presence of certain content without granting full read access to the target's messages. This is classified as an observable response discrepancy (CWE-204). The issue is addressed in version 3.12.3.
Affected products
- Cyrus IMAP Cyrus IMAP through 3.12.2
Timeline
- 2026-07-16: advisory
- 2026-07-16: disclosed
- 2026-07-16: patched: Fixed in version 3.12.3