CVE-2026-40018

A flaw was found in Dovecot. A remote attacker with high attack complexity could exploit this vulnerability to gain access to sensitive information and modify data without requiring any user interaction or privileges.

This vulnerability is rated Important rather than Moderate because an unauthenticated network attacker could execute arbitrary SQL commands against the backend database, potentially leading to unauthorized data modification and disclosure of sensitive mailbox information. On Red Hat Enterprise Linux, Dovecot is not active by default and relies on standard system authentication methods unless explicitly configured otherwise. Consequently, only deployments actively configured to use MySQL or MariaDB database backends with multi-byte character handling are vulnerable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.