Vulnerability · Published Oct 31, 2025 · Assigned by OX
CVE-2025-30189
High 7.4
In plain English
A high-severity security flaw in OX Dovecot Pro from Open-Xchange GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users. After cached login, all subsequent logins are for same user. Install fixed version or disable caching either globally or for the impacted passdb/userdb drivers. No publicly available exploits are known.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | dovecot | 2.4.2-r0 | ALPINE-CVE-2025-30189 |
| Alpine:v3.24 | dovecot | 2.4.2-r0 | ALPINE-CVE-2025-30189 |
| Debian:13 | dovecot | 1:2.4.1+dfsg1-6+deb13u1 | DEBIAN-CVE-2025-30189 |
| Debian:13 | dovecot | 1:2.4.1+dfsg1-6+deb13u1 | DSA-6019-1 |
| Debian:14 | dovecot | 1:2.4.1+dfsg1-7 | DEBIAN-CVE-2025-30189 |
| Ubuntu:25.10 | dovecot | 1:2.4.1+dfsg1-5ubuntu4 | UBUNTU-CVE-2025-30189 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Open-Xchange GmbH | OX Dovecot Pro | 0 – through 3.1.00 – through 2.4.0 |
Weakness: CWE-1250 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N