PatchTheCVECVE-2026-40020: Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if im
CVE-2026-40020 is a low-severity flaw (CVSS 3.1) affecting dovecot, dovecot. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users. The impact is limited to being able to spam folders to other users, no unexpected access is gained. Install to fixed version. No publicly available exploits are known.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 3.1 (Low) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 82%) |
| CISA exploited list | No |
| Weakness | CWE-284 |
| Published | 2026-05-12 |
| Last modified | 2026-10-26 |
Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-40020?
dovecot: upgrade to 2.4.4; dovecot: upgrade to 3.1.5. Exact commands for each OS are on this page.
Is CVE-2026-40020 being exploited?
CVE-2026-40020 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-40020 affect?
CVE-2026-40020 affects dovecot, dovecot. Severity is low (CVSS 3.1). Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users. The impact is limited to being able to spam folders to oth
How urgent is CVE-2026-40020?
Priority 15/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2026-27855 MEDIUM 6.8 UPGRADE UPGRADE Dovecot OTP authentication is vulnerable to replay attack under specific conditions
- CVE-2026-27857 MEDIUM 4.3 UPGRADE UPGRADE Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage
- CVE-2026-27858 HIGH 7.5 UPGRADE UPGRADE Attacker can send a specifically crafted message before authentication that causes managesieve to allocate lar
- CVE-2026-24031 HIGH 7.7 UPGRADE UPGRADE Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin
- CVE-2026-27856 HIGH 7.4 UPGRADE UPGRADE Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack