OX Dovecot Pro CVE-2026-40205

Three specific conditions must all be present for exploitation: (1) Dovecot must be configured with an OAuth2 authorization policy requiring more than one scope (single-scope configurations are not affected); (2) the Dovecot instance must be using the remote token validation path rather than local token validation - deployments already using local validation are not vulnerable; (3) the attacker must possess a valid OAuth2 token carrying at least one, but not all, of the required scopes, meaning they must be a known principal in the authorization server with at least some legitimately granted access. What limits exploitation: the attacker cannot be fully unauthenticated (PR:L), the misconfiguration of multi-scope with remote validation must be present (AC:H), and the scope discrepancy must be meaningful enough to unlock additional capabilities. There is no requirement for user interaction and no platform restriction beyond the affected Dovecot product.

The CVSS 5.9 Medium score is derived from AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N, which accurately reflects the conditional nature of this flaw. High Attack Complexity (AC:H) is appropriate because two non-default conditions must coincide: Dovecot must be configured to require multiple OAuth2 scopes, and the deployment must rely on remote (not local) token validation. PR:L correctly captures that the attacker must already possess a legitimately issued OAuth2 token - even a narrowly scoped one - meaning fully unauthenticated attackers are excluded. The High Integrity impact (I:H) is the most consequential signal: an attacker can perform write-level or otherwise restricted mail operations that their token should not authorize. No EPSS score is available in the input data. There is no CISA KEV listing and no public exploit code - the vendor itself states no publicly available exploits are known. The real-world priority is moderate: organizations with multi-scope OAuth2 Dovecot deployments using remote validation should treat this as an urgent configuration or patch action, while those using local validation or single-scope configurations are not affected.

An attacker is issued a legitimate OAuth2 token by the authorization server granting only a read scope, when Dovecot is configured to require both read and write scopes for access. By submitting this partial-scope token to a Dovecot instance using remote token validation, the attacker bypasses the multi-scope enforcement and gains write-level mail access - deleting, moving, or modifying messages - that the token should not have authorized. No public exploit code is known, but the attack requires only a valid OAuth2 client credential and knowledge of the target's scope configuration.