VDB
CVE-2026-24031
CVE-2026-24031
PUBLISHED
CVSS 7.699999809265137 HIGH
Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.
EPSS 0.03% · 10.7th percentile
Risk Scores
CVSS v3.1
7.699999809265137
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
EPSS Score
0.03%
10.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| open-xchange | dovecot | 0 |
| Open-Xchange GmbH | OX Dovecot Pro | 0, 0, 0 |
| dovecot | dovecot | 0 |
Timeline
- Mar 27, 2026 Coalition ESS Score
- Mar 27, 2026 CVE Published
- Mar 27, 2026 PoC Published
- Mar 27, 2026 PoC Published
- Mar 27, 2026 CVE Updated
- Mar 27, 2026 PoC Published
- Mar 29, 2026 Security Advisory
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 20, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score