PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40020 Open-Xchange GmbH CVE debrief

CVE-2026-40020 is a LOW-severity vulnerability (CVSS 3.1) in Dovecot affecting versions prior to 2.4.4 and Dovecot Pro prior to 3.1.5. Published 2026-05-12 and last modified 2026-05-18, this issue allows an authenticated attacker with IMAP access to inject the 'anyone' permission into a user's dovecot-acl file via the SETACL command, even when the imap_acl_allow_anyone configuration option is set to no. This can result in folders being spammed to all users on the system. The vendor explicitly notes that no unexpected access is gained beyond this folder visibility issue. The vulnerability was assigned CWE-284 (Improper Access Control) by the vendor, though NVD has not yet assigned a specific CWE. No publicly available exploits are known, and the issue is not listed in CISA KEV.

Vendor
Open-Xchange GmbH
Product
OX Dovecot Pro
CVSS
LOW 3.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-18
Advisory published
2026-05-12
Advisory updated
2026-05-18

Who should care

Organizations running Dovecot mail servers with IMAP ACL functionality enabled, particularly those relying on imap_acl_allow_anyone=no to restrict folder sharing. Security teams should prioritize patching during routine maintenance windows given the LOW severity and requirement for authenticated access.

Technical summary

The vulnerability exists in Dovecot's IMAP ACL implementation. When an authenticated user issues a SETACL command, the server fails to properly enforce the imap_acl_allow_anyone=no restriction, allowing the 'anyone' identifier to be written to the dovecot-acl file. This causes the affected folder to become visible to all users on the system. The issue requires authenticated IMAP access and high attack complexity (AC:H), with low privileges required (PR:L). The attack has no confidentiality or integrity impact, with low availability impact due to folder spam potential. Fixed versions implement proper validation of the 'anyone' identifier against the imap_acl_allow_anyone setting before writing ACL entries.

Defensive priority

routine

Recommended defensive actions

  • Upgrade Dovecot to version 2.4.4 or later, or Dovecot Pro to version 3.1.5 or later.
  • Verify imap_acl_allow_anyone configuration and review existing dovecot-acl files for unauthorized 'anyone' entries.
  • Monitor IMAP logs for suspicious SETACL commands targeting shared folders.

Evidence notes

CVSS 3.1 score 3.1 (LOW) per NVD. Affected versions: Dovecot < 2.4.4, Dovecot Pro < 3.1.5 per CPE data. Vendor advisory confirms imap_acl_allow_anyone=no bypass via SETACL command injection. Impact limited to folder spamming, no privilege escalation.

Official resources

2026-05-12