Vulnerability · Published May 12, 2026 · Assigned by OX
CVE-2026-40020
Low 3.1
In plain English
A low-severity improper access control in OX Dovecot Pro from Open-Xchange GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users. The impact is limited to being able to spam folders to other users, no unexpected access is gained. Install to fixed version. No publicly available exploits are known.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.23 | dovecot | 2.4.4-r0 | ALPINE-CVE-2026-40020 |
| Alpine:v3.24 | dovecot | 2.4.4-r0 | ALPINE-CVE-2026-40020 |
| Debian:12 | dovecot | 1:2.3.19.1+dfsg1-2.1+deb12u6 | DEBIAN-CVE-2026-40020 |
| Debian:13 | dovecot | 1:2.4.1+dfsg1-6+deb13u6 | DEBIAN-CVE-2026-40020 |
| Debian:14 | dovecot | 1:2.4.4+dfsg1-1 | DEBIAN-CVE-2026-40020 |
| Ubuntu:22.04:LTS | dovecot | 1:2.3.16+dfsg1-3ubuntu2.9 | UBUNTU-CVE-2026-40020 |
| Ubuntu:24.04:LTS | dovecot | 1:2.3.21+dfsg1-2ubuntu6.5 | UBUNTU-CVE-2026-40020 |
| Ubuntu:25.10 | dovecot | 1:2.4.1+dfsg1-5ubuntu4.2 | UBUNTU-CVE-2026-40020 |
| Ubuntu:26.04:LTS | dovecot | 1:2.4.2+dfsg1-3ubuntu2.1 | UBUNTU-CVE-2026-40020 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Open-Xchange GmbH | OX Dovecot Pro | 0 – through 2.3.0 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L