CVE-2026-24031 is an SQL injection vulnerability found in Open-Xchange GmbH's OX Dovecot Pro, specifically affecting the SQL-based authentication mechanism. The vulnerability is triggered when the 'auth_username_chars' configuration parameter is cleared by an administrator. This parameter normally restricts allowed characters in usernames during authentication. Clearing it removes these restrictions, allowing specially crafted input containing SQL special characters to be injected into authentication queries. Consequently, attackers can bypass authentication controls entirely, gaining unauthorized access to any user account without valid credentials. Additionally, the flaw enables user enumeration by exploiting the SQL injection vector. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high severity, with network attack vector, high attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity. No public exploits have been reported yet, but the vulnerability is critical due to the potential for unauthorized access and data exposure. The affected versions are not explicitly detailed but pertain to OX Dovecot Pro installations where 'auth_username_chars' is cleared. The vendor recommends not clearing this setting or applying the latest fixed software version to remediate the issue.

The vulnerability allows attackers to bypass authentication controls and impersonate any user, leading to unauthorized access to sensitive email and system data. This compromises confidentiality and integrity of user accounts and potentially the entire mail server environment. User enumeration can facilitate targeted attacks or phishing campaigns. Although availability impact is low, the breach of authentication can lead to further exploitation, lateral movement, or data exfiltration. Organizations relying on OX Dovecot Pro for email services, especially those with sensitive communications, face significant risk of data breaches and operational disruption. The ease of remote exploitation without authentication or user interaction increases the threat level. This can undermine trust in organizational communications and lead to regulatory and compliance consequences.

Administrators should ensure that the 'auth_username_chars' configuration parameter is not cleared or left empty, maintaining proper input validation on usernames. Immediate upgrade to the latest patched version of OX Dovecot Pro provided by Open-Xchange GmbH is strongly recommended to address the vulnerability. Implement network-level protections such as restricting access to authentication services via firewalls and VPNs to limit exposure. Employ monitoring and alerting for unusual authentication attempts or user enumeration patterns. Conduct regular security audits and penetration testing focused on authentication mechanisms. Consider deploying Web Application Firewalls (WAFs) with SQL injection detection capabilities as an additional layer of defense. Maintain up-to-date backups and incident response plans to quickly recover from potential compromises.