CVE-2026-40020 Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no.

What is CVE-2026-40020?

CVE-2026-40020 is a low-severity vulnerability in Dovecot Dovecot, published on 12 May 2026.

Official description

Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users. The impact is limited to being able to spam folders to other users, no unexpected access is gained. Install to fixed version. No publicly available exploits are known.

Weakness: CWE-284

Which versions are affected by CVE-2026-40020?

It affects 2 products.

Products include Dovecot Dovecot, Open-Xchange Dovecot.

How do I fix CVE-2026-40020?

Upgrade to a fixed version.

Is CVE-2026-40020 being exploited?

There is no known exploitation of CVE-2026-40020 in the wild and no public exploit code.

Other vulnerabilities in Dovecot Dovecot

• CVE-2026-24031 Auth bypass in OX Dovecot Pro High 7.7
• CVE-2025-59032 Denial of service in OX Dovecot Pro High 7.5
• CVE-2026-27858 Denial of service in OX Dovecot Pro High 7.5
• CVE-2021-29157 Path traversal in n/a High 7.5
• CVE-2020-10957 Null dereference in n/a High 7.5

All Dovecot Dovecot vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-40020, AZL-86808, DEBIAN-CVE-2026-40020, GHSA-h6rp-9mjf-6x88, UBUNTU-CVE-2026-40020.