EUVD-2026-67661
GHSA-wf8m-g4w9-3rc5
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Mail content is network-delivered (AV:N), but exploitation requires admin-initiated dsync stream operation (AC:H, UI:R); authenticated user required (PR:L); only destination mailbox integrity is impacted (I:H, C:N, A:N).
Primary rating from Vendor (OX).
CVSS VectorVendor: OX
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, including internal mailbox attributes that a user should not be able to set directly. It can also cause dsync errors. Avoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version. No publicly available exploits are known.
AnalysisAI
Dsync stream protocol command injection in OX Dovecot Pro and OX Dovecot CE allows an authenticated mail user to store crafted content that is later interpreted as dsync protocol commands when an administrator runs dsync with the stream protocol during a migration or replication. Successful injection enables modification of mailbox state on the destination server, including internal mailbox attributes that a user should not be able to manipulate directly. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific conditions must both be met: first, the attacker must be an authenticated mail user with the ability to store content in a mailbox (CVSS PR:L confirms low-privilege authenticated access is sufficient); second, an administrator must actively invoke dsync using the stream protocol against that mailbox - for example, explicitly during a server-to-server migration or a replication sync operation (CVSS UI:R and AC:H confirm this dependency). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.8 (Medium) is well-calibrated for this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to update to the non-vulnerable release of OX Dovecot Pro or OX Dovecot CE as specified in the Open-Xchange CSAF advisory at https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0003.json; the exact patched version number is not independently confirmed from the available data and administrators must consult that advisory directly rather than relying on an unverified version number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ox Dovecot Pro
View allAuthentication-layer injection in OX Dovecot Pro (versions up to and including 2.4.3 and 3.1.4) arises from a flaw in th
Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve
Authentication bypass and user enumeration in OX Dovecot Pro (versions up to and including 3.1.0 and the 2.4.x line up t
OX Dovecot Pro ManageSieve service crashes when processing AUTHENTICATE commands with SASL initial responses using liter
OX Dovecot Pro managesieve-login process crashes repeatedly due to memory exhaustion triggered by unauthenticated attack
Remote memory-exhaustion denial of service in OX Dovecot Pro (versions up to and including 2.3.0) lets an unauthenticate
Denial of service in OX Dovecot Pro and OX Dovecot CE allows unauthenticated remote attackers to exhaust memory and CPU
ManageSieve login process in OX Dovecot CE and Pro crashes on receipt of a small malformed pre-authentication command, e
Memory exhaustion in OX Dovecot Pro and OX Dovecot CE allows any remote sender to deny IMAP service to a targeted user b
OAuth2 token validation in OX Dovecot Pro and OX Dovecot CE contains a logic error that permits authentication bypass wh
SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-comp
Stack exhaustion via crafted compressed IMAP data in OX Dovecot Pro and OX Dovecot CE allows an authenticated remote att
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today