Is CVE-2026-40020 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40020 being exploited in the wild.

How severe is CVE-2026-40020?

Low severity, with a CVSS score of 3.1, published 12 May 2026.

Which products and versions are affected?

Open-Xchange Dovecot CE 2.4.0, 2.4.3, 2.4.4; Open-Xchange Dovecot Pro 2.3.0, 3.0.5, 3.1.0, 3.1.4, 3.1.5.

Is there a fix for CVE-2026-40020?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40020 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-40020?

Check whether you run Dovecot, Open-Xchange Dovecot CE or Open-Xchange Dovecot Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40020: Open-Xchange Dovecot improper access control in IMAP SETACL

CVE-2026-40020 · Severity: low · CVSS 3.1 · Published 2026-05-12

Dovecot is a popular open-source email server used to handle incoming mail. A vulnerability allows an authenticated user to bypass security settings and share folders with all other users on the system. While this does not grant unauthorized access to private emails, it can be used to clutter or 'spam' the folder lists of every user on the server.

Technologies: Dovecot, Open-Xchange Dovecot CE, Open-Xchange Dovecot Pro. Vendors: Dovecot, Open-Xchange.

Quick answers

Is CVE-2026-40020 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40020 being exploited in the wild.
How severe is CVE-2026-40020?: Low severity, with a CVSS score of 3.1, published 12 May 2026.
Which products and versions are affected?: Open-Xchange Dovecot CE 2.4.0, 2.4.3, 2.4.4; Open-Xchange Dovecot Pro 2.3.0, 3.0.5, 3.1.0, 3.1.4, 3.1.5.
Is there a fix for CVE-2026-40020?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40020 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-40020?: Check whether you run Dovecot, Open-Xchange Dovecot CE or Open-Xchange Dovecot Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in Dovecot's IMAP SETACL command handling allows an authenticated user to inject 'anyone' permissions into a user's dovecot-acl file. This occurs even when the configuration 'imap_acl_allow_anyone' is explicitly set to 'no'. The root cause is improper access control (CWE-284) during the processing of ACL modification commands. An attacker with valid login credentials can exploit this to make specific folders visible to all users on the system. The impact is limited to folder 'spamming' and does not result in unauthorized data disclosure or privilege escalation.

Affected products

Open-Xchange Dovecot Pro 2.3.0, 3.0.5, 3.1.0, 3.1.4, 3.1.5
Open-Xchange Dovecot CE 2.4.0, 2.4.3, 2.4.4

Timeline

2026-05-12: advisory: Initial public release of the advisory
2026-05-12: disclosed: CVE-2026-40020 published to NVD

References

https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0002.json

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.