CVE-2026-47083

mediumpriority · track · 0EPSS 0.003 · 23 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.31% (23rd) EPSS

CVSS 4.3 · medium

Is it mine?

4 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · cert_bund

EPSS · scored 2026-10-28

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching the search, creating a content oracle (without allowing arbitrary reads of the target's content).

cvss

Technical severity, 0–10. One row per scoring source.

4.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:Nsecondary · cve@mitre.org USexploitability 2.8 · impact 1.4

v3.14mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-204USprimary

affected products (4)

Products and version ranges known to be affected.

Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
SUSE openSUSEall versionscert_bundDEcpe:/o:suse:opensuse:-
Open Source cyrus imap< 3.12.3cert_bundDE
cyrusimap Cyrus IMAP0 → 3.12.3enisa_euvdEU

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-2387cyrus imap: Mehrere SchwachstellenDeutsch2026-07-16csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in cyrus imap ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Daten offenzulegen oder zu manipulieren.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund NVD CVE.org MITRE

published 2026-07-16modified 2026-10-24

related (248)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2018-7790US	critical9.8OT elevated	2.48% (85th)	—	2018-08-29
An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allow…
CVE-2019-19030US	medium5.3	1.98% (81st)	Exploit	2022-12-26
Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether…
CVE-2022-23342US	medium5.3	1.28% (70th)	Exploit	2022-06-21
The Hyland Onbase Application Server releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.1000 are vulnerable to a username enumeration vulnerability. An…
CVE-2015-7902US	medium5.0	3.50% (89th)	Exploit	2015-10-28
Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances, which allows r…
CVE-2002-0212US	high7.5OT elevated	1.59% (76th)	—	2002-05-16
The login for Hosting Controller 1.1 through 1.4.1 returns different error messages when a valid or invalid user is provided, which allows remote attackers to determine the existen…

+243 more

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan