Threats Tagged 'cve-2026-40205'

Multiple critical security vulnerabilities affecting Dovecot 2.4.4 and related versions in Red Hat Enterprise Linux 8 have been addressed in an update to version 2.3.16-16.el8_10. These vulnerabilities include denial of service, authentication bypass, and remote code execution issues across various Dovecot components such as IMAP, ManageSieve, and sieve scripts. The update fixes critical issues including a use-after-free leading to arbitrary code execution and several denial of service vulnerabilities caused by malformed inputs or resource exhaustion.

CVE-2026-40205 is an improper authentication vulnerability in Open-Xchange GmbH OX Dovecot Pro. The issue arises when OAuth2 tokens with only partial required scopes are accepted during remote token validation, despite the configuration requiring multiple scopes. This leads to a failure in enforcing the configured authorization policy, allowing tokens with insufficient permissions to authenticate. Local token validation correctly enforces all required scopes. No public exploits are known for this vulnerability.

CVE-2026-40205 is an improper authentication vulnerability in Open-Xchange GmbH OX Dovecot Pro. The issue arises when OAuth2 tokens with only partial required scopes are accepted by remote token validation paths, despite the configured authorization policy requiring all scopes. This results in tokens with incomplete permissions being accepted incorrectly. Local token validation correctly enforces all required scopes. No public exploits are known, and the vulnerability has a medium severity rating.