CVE-2026-40205

A flaw was found in Dovecot. An attacker with a partially valid OAuth2 token can bypass authorization checks in remote token validation paths. This allows the attacker to authenticate with insufficient permissions, leading to a breach of integrity where the configured authorization policy is not properly enforced.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, configure Dovecot to use local OAuth2 token validation instead of remote validation. This ensures that all required scopes are correctly enforced during authentication, preventing unauthorized access with partially valid tokens. Consult Dovecot documentation for specific configuration steps to enable local token validation. A service restart may be required for the changes to take effect.