Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2026-40020: Debian OpenSSL Library Allows Unauthorized Key Use
CVE-2026-40020 · published 5 months ago
Summary
An issue in Debian's OpenSSL library can allow attackers to use unauthorized keys, potentially leading to data breaches or unauthorized access. This affects Debian Linux systems using OpenSSL for encryption. To mitigate this, update your Debian system to the latest version of OpenSSL and ensure you are using secure key management practices.
What to do
- Update alpine dovecot to version 2.4.4-r0.
- Update debian dovecot to version 1:2.3.19.1+dfsg1-2.1+deb12u6.
- Update debian dovecot to version 1:2.4.1+dfsg1-6+deb13u6.
- Update debian dovecot to version 1:2.4.4+dfsg1-1.
- Update dovecot to version 2.4.4-r0.
- Update dovecot dovecot to version 2.4.4 or later.
- Update open-xchange dovecot to version 3.1.5 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | dovecot | All versions |
| Debian:12 | debian | dovecot |
< 1:2.3.19.1+dfsg1-2.1+deb12u6 Fix: upgrade to 1:2.3.19.1+dfsg1-2.1+deb12u6
|
| Debian:13 | debian | dovecot |
< 1:2.4.1+dfsg1-6+deb13u6 Fix: upgrade to 1:2.4.1+dfsg1-6+deb13u6
|
| Debian:14 | debian | dovecot |
< 1:2.4.4+dfsg1-1 Fix: upgrade to 1:2.4.4+dfsg1-1
|
| – | dovecot | dovecot |
< 2.4.4 cpe:2.3:a:dovecot:dovecot:*:*:*:*:*:*:*:* |
| – | open-xchange | dovecot |
< 3.1.5 cpe:2.3:a:open-xchange:dovecot:*:*:*:*:pro:*:*:* |
| Ubuntu:Pro:14.04:LTS | canonical | dovecot | All versions |
| Ubuntu:16.04:LTS | canonical | dovecot | All versions |
| Ubuntu:18.04:LTS | canonical | dovecot | All versions |
| Ubuntu:20.04:LTS | canonical | dovecot | All versions |
| Ubuntu:22.04:LTS | canonical | dovecot | All versions |
| Ubuntu:24.04:LTS | canonical | dovecot | All versions |
| Ubuntu:25.10 | canonical | dovecot | All versions |
| Ubuntu:26.04:LTS | canonical | dovecot | All versions |
| Alpine:v3.24 | alpine | dovecot |
< 2.4.4-r0 Fix: upgrade to 2.4.4-r0
|
| Alpine:v3.23 | – | dovecot |
< 2.4.4-r0 Fix: upgrade to 2.4.4-r0
|
Original advisory text
Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users. The impact is l...
Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be spammed to all users. The impact is limited to being able to spam folders to other users, no unexpected access is gained. Install to fixed version. No publicly available exploits are known.
References
- https://security-tracker.debian.org/tracker/CVE-2026-40020 Vendor Advisory
- https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxd... Vendor Advisory
- https://www.openwall.com/lists/oss-security/2026/05/12/6 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-40020 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-40020 Third Party Advisory
- https://security.alpinelinux.org/vuln/CVE-2026-40020 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40020... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-40020 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-284Improper Access Control
Timeline
Published12 May 2026
Updated4 Nov 2026
First seen12 May 2026
Sources
DEBIAN-CVE-2026-40020 · OSV
CVE-2026-40020 · NVD
UBUNTU-CVE-2026-40020 · OSV
ALPINE-CVE-2026-40020 · OSV
CVE-2026-40020 · OSV
Track software like this
Free during beta