CVE-2026-40020

ℹ️ low

Summary

Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users. The impact is limited to being able to spam folders to other users, no unexpected access is gained. Install to fixed version. No publicly available exploits are known.

CVSS Score

3.1

Low

EPSS Score

0.0

Exploit Probability

Published Date

2026-05-12

First Seen: 2026-05-19

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 2.1% of all 321,566 vulnerabilities in our database.

#314,805

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 12, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2026-05-18

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE IDs (Weakness Types)

CWE-284

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
dovecot	dovecot	Affected	< 2.4.4

🔗 References 1

https://documentation.open-xchange.com/dovecot/secur...

Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-27851	⚠️ high	7.4	0.0	When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted...	2026-05-12
CVE-2026-33603	🔶 medium	6.8	0.0	Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This ...	2026-05-12
CVE-2026-40016	🔶 medium	5.3	0.0	Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits ...	2026-05-12
CVE-2026-42006	🔶 medium	4.3	0.0	An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomple...	2026-05-12
CVE-2025-59028	🔶 medium	5.3	0.1	When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentica...	2026-03-27
CVE-2025-59032	⚠️ high	7.5	0.1	ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSi...	2026-03-27

These CVEs affect the same products