CVE-2026-40205: Improper Authentication in Open-Xchange GmbH OX Dovecot Pro

The vulnerability in OX Dovecot Pro involves improper enforcement of OAuth2 token scope requirements during remote token validation. When multiple scopes are configured as required, the remote validation path erroneously accepts tokens that carry only one of the required scopes instead of all. This bypasses the intended authorization policy, allowing authentication with insufficient permissions. The local token validation path does not exhibit this flaw and correctly requires all scopes. The vendor recommends using local token validation where possible and updating to a non-vulnerable version. No exploits have been publicly reported.

An attacker possessing an OAuth2 token with only a subset of the required scopes can authenticate successfully where full scope authorization is expected. This leads to a violation of the configured authorization policy, potentially allowing unauthorized access or privilege escalation within the affected system. The impact includes partial compromise of integrity due to acceptance of insufficiently scoped tokens. Confidentiality impact is low and availability is not affected.

Use local token validation where tokens can be validated locally, as it correctly enforces all required scopes. The vendor advises updating to a non-vulnerable version of OX Dovecot Pro when available. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. No public exploits are known, so immediate emergency response is not indicated.