What is the CVSS score of CVE-2026-40020?

CVE-2026-40020 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40020?

Yes, a patch is available for CVE-2026-40020. Update the affected software to the latest version immediately.

OX Dovecot Pro CVE-2026-40020

EUVD-2026-29471 LOW

Improper Access Control (CWE-284)

2026-05-12 OX

GHSA-h6rp-9mjf-6x88

Authentication Bypass Ox Dovecot Pro

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 14:16 vuln.today

CVE Published

May 12, 2026 - 13:28 nvd

LOW 3.1

DescriptionCVE.org

Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users. The impact is limited to being able to spam folders to other users, no unexpected access is gained. Install to fixed version. No publicly available exploits are known.

AnalysisAI

OX Dovecot Pro is vulnerable to IMAP SETACL command injection that allows authenticated users to bypass the imap_acl_allow_anyone configuration setting and inject the anyone permission into dovecot-acl files, enabling spam of mailbox folders to all users. The vulnerability requires authentication and elevated complexity conditions (CVSS 3.1), and no public exploits are known at the time of analysis.

Technical ContextAI

Dovecot is an open-source IMAP/POP3 mail server that implements the IMAP4rev1 Access Control List (ACL) extension (RFC 4314) to manage per-folder permissions. The vulnerability exists in Dovecot Pro's SETACL command implementation, which is intended to allow users to modify access control lists for their mailboxes. The imap_acl_allow_anyone configuration option is designed to restrict whether the special 'anyone' identifier-representing all users-can be granted permissions. The flaw allows an authenticated attacker to inject the 'anyone' permission into the dovecot-acl file even when the administrator has explicitly disabled this feature via imap_acl_allow_anyone=no, circumventing the intended access control policy (CWE-284: Improper Access Control). The impact is limited to mail delivery disruption via spam rather than unauthorized access to protected data.

RemediationAI

Upgrade OX Dovecot Pro to the fixed version specified in the OX security advisory at https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json. Until patching is possible, administrators can enforce mitigation by restricting IMAP access to trusted users only via firewall rules or authentication-based access controls, or by implementing mail flow policies that prevent excessive folder sharing requests. However, these workarounds do not eliminate the vulnerability itself, only reduce exposure surface. A secondary mitigation is to audit existing dovecot-acl files for unexpected 'anyone' entries and remove them manually, though this must be repeated until the patch is applied.