OX Dovecot Pro CVE-2026-40020

Exploitation requires: (1) valid IMAP credentials for any user account on the OX Dovecot Pro server; (2) access to issue IMAP SETACL commands (standard IMAP4rev1 client capability); (3) a mailbox folder on which the attacker has sufficient permissions to execute SETACL (typically their own folders or delegated mailboxes). The vulnerability only manifests when imap_acl_allow_anyone is explicitly set to 'no' in the Dovecot configuration-if the setting is not present or is left at default, the bypass does not apply. No special network conditions, user interaction, or non-default features are required beyond valid authentication.

This vulnerability presents a low-to-moderate real-world risk despite its low CVSS score of 3.1. The attack vector is network-accessible and requires low authentication (PR:L), but the attack complexity is high (AC:H), which explains the low numeric score. The primary mitigating factor is that exploitation requires valid IMAP credentials-an attacker cannot conduct this attack unauthenticated. The availability impact is limited (A:L) as the vulnerability enables spam/disruption rather than data breach or system compromise. No KEV status is provided and no public exploits are known, indicating this is not currently being actively weaponized. However, the vulnerability directly contradicts administrator intent by allowing bypass of a specific security configuration, which may be prioritized in environments where mail integrity and user experience are critical. The high attack complexity (AC:H) suggests either timing constraints, specific configuration requirements, or exploitation difficulty that reduces likelihood compared to network attacks with AC:L. Organizations with strict email governance policies should prioritize patching; others may defer until routine maintenance windows.

An authenticated user with valid IMAP credentials connects to the mail server and issues a crafted SETACL command on a mailbox folder, specifying the 'anyone' identifier with read or deliver permissions despite the server configuration setting imap_acl_allow_anyone=no. The command bypasses the configuration check and injects the permission into the dovecot-acl file. Subsequently, all users with access to the shared folder receive spam or unwanted messages delivered to that folder.