CVE-2026-24031
High · 7.7CVSS
7.7
EPSS
0.4%
Published
Mar 27, 2026
CISA due date
—
The record
Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | dovecot24 | 0 | 2.4.3-160000.1.1 |
| openSUSE:Tumbleweed | dovecot24 | 0 | 2.4.3-1.1 |
Related vulnerabilities
- CVE-2026-42006 An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. Also affects dovecot24
- CVE-2026-40016 Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to… Also affects dovecot24
- CVE-2026-40020 Attacker can use the IMAP SETACL command to inject the anyone permission to user's… Also affects dovecot24
- CVE-2026-33603 Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake… Also affects dovecot24
- CVE-2026-27851 When safe filter is used with variable expansion, all following pipelines on the same… Also affects dovecot24
- CVE-2026-27860 If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to… Also affects dovecot24
- CVE-2026-27858 Attacker can send a specifically crafted message before authentication that causes… Also affects dovecot24
- CVE-2026-27859 A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use… Also affects dovecot24