ByteOS Network

CVE Vulnerability Details :

CVE-2026-27860

PUBLISHED

More Info Official Page

Assigner-OX

Assigner Org ID-8ce71d90-2354-404b-a86e-bec2cc4e6981

Published At-27 Mar, 2026 | 08:10

Updated At-27 Mar, 2026 | 12:33

▼CVE Numbering Authority (CNA)

If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.

Affected Products

Vendor

Open-Xchange AG

Product

OX Dovecot Pro

Modules

core

Default Status

unaffected

Versions

Affected

From 0 through 3.1.0 (semver)
From 0 through 2.4.0 (semver)

Problem Types

Type	CWE ID	Description
cwe	CWE-90	Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Type: cwe

CWE ID: CWE-90

Description: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Metrics

Version	Base score	Base severity	Vector
3.1	3.7	LOW	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Version: 3.1

Base score: 3.7

Base severity: LOW

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

Hyperlink	Resource
https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json	vendor-advisory

Hyperlink: https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json

Resource:

vendor-advisory

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References