CVE-2026-24031 is a high-severity SQL injection vulnerability (CWE-89) in Dovecot's SQL-based authentication, which occurs when the 'auth_username_chars' setting is cleared by an administrator. This flaw allows attackers to bypass authentication for any user and enumerate user accounts. Rated 7.7 (High) on CVSS, it has a network attack vector and high impact on confidentiality and integrity, despite requiring high attack complexity. Currently, there are no known public exploits, Metasploit modules, or Nuclei templates, and it is not on the KEV catalog or Hot List, though it has garnered minimal community discussion. Administrators should avoid clearing 'auth_username_chars' or apply the latest fixed version.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.4.3CPE matchmatch criteria | cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:* | ||
< 3.1.4CPE matchmatch criteria | cpe:2.3:a:open-xchange:dovecot:*:*:*:*:pro:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Dovecot vulnerabilities
Mar 31, 2026v2.4/v3.1 regression: SQL injection allows bypassing authentication. Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin.
Mar 27, 2026Dovecot vulnerabilities