CVE-2026-47083

A flaw was found in Cyrus IMAP. An authenticated user can exploit the ESEARCH command to discover the existence of folder names belonging to other user accounts. This vulnerability leads to information disclosure, allowing an attacker to gain unauthorized knowledge about the structure of other users' mailboxes.

This Moderate impact information disclosure flaw in Cyrus IMAP allows an authenticated user to enumerate folder names belonging to other accounts via the ESEARCH command. While it does not permit arbitrary content reads, this vulnerability could expose the structure of other users' mailboxes, potentially aiding further reconnaissance.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.