The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade dovecot | Jul 30, 2024 | Oct 15, 2008 |
| Freebsd | — | Upgrade dovecot | Dec 10, 2025 | Nov 19, 2008 |
| Gentoo Linux | — | Upgrade net-mail/dovecot. | Oct 30, 2017 | Oct 15, 2008 |
| Oracle_linux | — | Upgrade dovecot | Oct 16, 2024 | Oct 15, 2008 |
| Suse | — | Upgrade dovecot-develUpgrade dovecot | Feb 17, 2015 | Oct 15, 2008 |
| Ubuntu | — | Upgrade dovecot-common | Nov 8, 2024 | Oct 15, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub