Open-Xchange Dovecot Pro/Dovecot CE Dsync injection

Summaryinfo

A vulnerability was found in Open-Xchange Dovecot Pro and Dovecot CE. It has been rated as problematic. This impacts an unknown function of the component Dsync. Performing a manipulation results in injection. This vulnerability is cataloged as CVE-2026-33606. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Open-Xchange Dovecot Pro and Dovecot CE (version unknown). This affects an unknown function of the component Dsync. The manipulation with an unknown input leads to a injection vulnerability. CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on integrity. The summary by CVE is:

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, including internal mailbox attributes that a user should not be able to set directly. It can also cause dsync errors. Avoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version. No publicly available exploits are known.

The advisory is shared at documentation.open-xchange.com. This vulnerability is uniquely identified as CVE-2026-33606 since 03/23/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Additional levels of successful authentication are needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/28/2026). MITRE ATT&CK project uses the attack technique T1055 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-3076). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Open Source Dovecot

Productinfo

Type

• Mail Server Software

Vendor

• Open-Xchange

Name

• Dovecot CE
• Dovecot Pro

License

• open-source

Website

• Vendor: https://www.open-xchange.com/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion