{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24031", "assignerOrgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "state": "PUBLISHED", "assignerShortName": "OX", "dateReserved": "2026-01-20T14:56:25.872Z", "datePublished": "2026-03-27T08:10:18.100Z", "dateUpdated": "2026-03-27T12:33:25.301Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["core"], "product": "OX Dovecot Pro", "vendor": "Open-Xchange GmbH", "versions": [{"lessThanOrEqual": "3.1.0", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "2.4.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "cwe"}]}], "providerMetadata": {"orgId": "8ce71d90-2354-404b-a86e-bec2cc4e6981", "shortName": "OX", "dateUpdated": "2026-03-27T12:33:25.301Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json"}], "source": {"defect": "DOV-8781", "discovery": "EXTERNAL"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user and user enumeration. Do not clear auth_username_chars. If this is not possible, install latest fixed version. No publicly available exploits are known."}], "id": "CVE-2026-24031", "lastModified": "2026-03-27T09:16:19.447", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.5, "source": "security@open-xchange.com", "type": "Secondary"}]}, "published": "2026-03-27T09:16:19.447", "references": [{"source": "security@open-xchange.com", "url": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json"}], "sourceIdentifier": "security@open-xchange.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@open-xchange.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-03-27T09:37:34.070454+00:00", "value": {"mitigation_remediation": ["Ensure that auth_username_chars is never cleared in the configuration", "Install the latest fixed version of OX Dovecot Pro if the setting cannot be preserved", "Review and harden configuration management procedures to prevent accidental clearing of auth_username_chars", "Monitor authentication logs for signs of unauthorized login attempts"], "summary": {"action": "Patch", "impact": "Authentication bypass and user enumeration via Dovecot configuration"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Open\u2011Xchange GmbH\u2019s OX Dovecot Pro product. Specific version information is not provided in the CNA data, so it is assumed that all installed instances are at risk when the parameter is cleared.", "description_and_impact": "An attacker can bypass Dovecot\u2019s SQL\u2011based authentication when the configuration option auth_username_chars is cleared by an administrator. This misconfiguration allows the attacker to authenticate as any user and enumerate valid usernames, thereby compromising account integrity. The weakness is classified as CWE\u201189, which involves improper handling of input leading to unauthorized access.", "risk_and_exploitability": "The CVSS score of 7.7 indicates a high risk. No EPSS data is available, and the vulnerability is not listed in CISA\u2019s KEV catalog, suggesting lower current exploitation interest. The attack vector is inferred to be local or administrative, as the bypass requires an administrator to clear auth_username_chars. Because there are no publicly known exploits, the exploitation would likely involve manual reconfiguration or social engineering to change the setting, after which an attacker could authenticate as any user."}}}}, "created": "2026-03-27T09:45:45.795728+00:00", "title": "Authentication Bypass via Dovecot SQL Authentication When auth_username_chars Cleared", "updated": "2026-03-27T09:45:45.795752+00:00", "vendors": []}