The vulnerability arises from improper preservation of consistency between independent representations of shared state in OX Dovecot Pro. Specifically, when caching is enabled, some passdb/userdb drivers incorrectly cache all users under the same cache key. This leads to incorrect cached information being used for different users, causing all subsequent logins after a cached login to authenticate as the same user. This can result in unauthorized access to user accounts. The vendor recommends installing a fixed version or disabling caching globally or for the impacted drivers. No public exploits have been reported.

Successful exploitation allows an attacker to gain unauthorized access by causing multiple users to be authenticated as the same cached user, leading to potential confidentiality and integrity violations. The vulnerability does not affect availability. The CVSS score of 7.4 reflects a high impact on confidentiality and integrity with network attack vector and no privileges or user interaction required.

A fix is available by installing the vendor's fixed version of OX Dovecot Pro. Alternatively, disabling caching either globally or specifically for the impacted passdb/userdb drivers mitigates the issue. Since no vendor advisory or patch links are provided, confirm patch availability with the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.