Dovecot Vulnerabilities Allow SQL Injection, Authentication Bypass, Info Exposure

CERT-Bund has released advisory WID-SEC-2026-0891 concerning multiple critical vulnerabilities in Dovecot, an open-source IMAP and POP3 email server. The vulnerabilities, rated with a CVSS base score of 7.7, allow remote attackers to conduct SQL injection attacks, bypass authentication mechanisms, disclose confidential information, and potentially cause denial-of-service conditions. The advisory affects Dovecot versions prior to 2.4.0 and prior to 2.4.3.

Organizations using affected versions of Dovecot must apply available mitigations immediately to prevent exploitation. This includes updating to a patched version or implementing specific security configurations as recommended by the vendor. Failure to address these vulnerabilities could lead to significant data breaches, unauthorized access to email accounts, and disruption of email services.