Home

Description

If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.

PUBLISHED Reserved 2026-02-24 | Published 2026-03-27 | Updated 2026-03-27 | Assigner OX




LOW: 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Problem types

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Product status

Default status
unaffected

Any version
affected

Any version
affected

References

documentation.open-xchange.com/...26/oxdc-adv-2026-0001.json vendor-advisory

cve.org (CVE-2026-27860)

nvd.nist.gov (CVE-2026-27860)

Download JSON