1. Home
  2. CVE Database
  3. CVE-2026-27860
LOW · 3.7

CVE-2026-27860

If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure....

Vulnerability Description

If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure. Do not clear out auth_username_chars, or install fixed version. No publicly available exploits are known.

CVSS Score

3.7

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
DovecotDovecot< 2.4.3
Open-XchangeDovecot< 3.1.4

Related Weaknesses (CWE)

CWE-90

References

FAQ

What is CVE-2026-27860?

CVE-2026-27860 is a vulnerability with a CVSS score of 3.7 (LOW). If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and allows probing of LDAP structure....

How severe is CVE-2026-27860?

CVE-2026-27860 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-27860?

Check the references section above for vendor advisories and patch information. Affected products include: Dovecot Dovecot, Open-Xchange Dovecot.