Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.
← back | CVE Intelligence

CVE-2026-24031 [High]

Curated 1 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-24031.

Vendor
Open-Xchange
Product
Dovecot
Affected versions
Dovecot >= 2.4.0, < 2.4.3; OX Dovecot Pro >= 3.1.0, < 3.1.4; requires SQL passdb and empty auth_username_chars
CVSS
7.7
Coverage Span
2026-08-12
Reports
1 related reports

Associated Reports & Timeline

1.
CVE-2026-24031 PoC: Dovecot SQL authentication bypass and user enumeration
github.com | tool | | original ↗ | #public-poc | #authentication-bypass | #sql-injection | #pre-auth
A Python PoC for CVE-2026-24031, a Dovecot SQL passdb injection allowing authentication bypass and user enumeration when auth_username_chars is emptied; validated on Dovecot 2.4.0 with PostgreSQL.
Why it matters: The public PoC demonstrates that the vulnerable configuration can turn a mail authentication query into unauthenticated remote account takeover and user enumeration. Restore a safe auth_username_chars value and upgrade to Dovecot 2.4.3 or OX Dovecot Pro 3.1.4 or later.