← Back

CVE-2026-40020

nvd nist
Published: May 12, 2026Modified: Jun 17, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Exploitability: 2.8 / Impact: 1.4
Source: NVD

Description

Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users. The impact is limited to being able to spam folders to other users, no unexpected access is gained. Install to fixed version. No publicly available exploits are known.

Affected (2)

Dovecot
1 product
Dovecot
Open Xchange
1 product
Dovecot
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Dovecot
Before 2.4.4
Dovecot
Before 3.1.5

Related CWEs

CWE-284
Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (1)

Source: security@open-xchange.com
Vendor Advisory

Timeline

No history available yet.