{"id":"CVE-2026-24031","state":"PUBLISHED","title":"Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration.","description":"Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known.","publishedAt":"2026-03-27T08:10:18.100Z","updatedAt":"2026-07-15T01:17:37.386Z","severity":{"score":7.7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","source":"OX"},"assigner":"OX","products":["Open-Xchange GmbH OX Dovecot Pro"],"affected":[{"vendor":"Open-Xchange GmbH","product":"OX Dovecot Pro","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.1.0","versionType":"semver"},{"version":"0","status":"affected","lessThanOrEqual":"2.4.0","versionType":"semver"}],"modules":["core"]}],"references":["https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json","https://access.redhat.com/security/cve/CVE-2026-24031","https://bugzilla.redhat.com/show_bug.cgi?id=2452181","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24031.json"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:11:21.040Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/24xxx/CVE-2026-24031.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-24031","state":"PUBLISHED","datePublished":"2026-03-27T08:10:18.100Z","dateUpdated":"2026-07-15T01:17:37.386Z","assignerShortName":"OX","assignerOrgId":"8ce71d90-2354-404b-a86e-bec2cc4e6981","dateReserved":"2026-01-20T14:56:25.872Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known."}],"affected":[{"vendor":"Open-Xchange GmbH","product":"OX Dovecot Pro","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"3.1.0","versionType":"semver"},{"version":"0","status":"affected","lessThanOrEqual":"2.4.0","versionType":"semver"}],"modules":["core"]}],"references":[{"url":"https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"cwe"}]}],"providerMetadata":{"shortName":"OX","orgId":"8ce71d90-2354-404b-a86e-bec2cc4e6981","dateUpdated":"2026-03-27T12:33:25.301Z"},"source":{"defect":"DOV-8781","discovery":"EXTERNAL"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-27T19:40:25.458839Z","id":"CVE-2026-24031","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-27T19:40:35.437Z"}},{"title":"dovecot: Dovecot: Authentication bypass and user enumeration due to cleared auth_username_chars configuration","descriptions":[{"lang":"en","value":"A flaw was found in Dovecot. When the `auth_username_chars` configuration is cleared by an administrator, it creates an authentication bypass vulnerability. This allows a remote attacker to gain unauthorized access to user accounts and enumerate valid usernames."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"dovecot","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"dovecot","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"dovecot","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"dovecot","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"dovecot","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-24031","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2452181","name":"RHBZ#2452181","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24031.json","tags":["x_sadp-csaf-vex"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-07-15T01:17:37.386Z"},"datePublic":"2026-03-27T08:10:18.100Z","timeline":[{"lang":"en","time":"2026-03-27T09:02:06.766Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-03-27T08:10:18.100Z","value":"Made public."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}