Re: Safe upgrade path from 2.4.1 to 2.4.4 (CVE-2026-40020) on Debian 13

Hi Attila, hi all,

Thank you for the pointer to the Debian security tracker - confirmed
independently: trixie (security) dovecot-core 1:2.4.1+dfsg1-6+deb13u6 is
listed as fixed for CVE-2026-40020 (DSA-6313-1), and that is exactly the
version we have installed. Good to know we don't need to touch the
packaging for that.

However, this raises a separate question. We had a long-standing,
unrelated problem we suspected might share the same root cause:
legitimate ACL-based mailbox sharing (granting a user read access to
another user's mailbox via "doveadm acl set ... lookup read") does not
work for us - the shared mailbox simply never appears for the grantee,
neither through "doveadm mailbox list" nor through a real IMAP LIST
command.

We just re-tested this live, now that the CVE fix is confirmed present:

- "doveadm acl set -u owner@domain INBOX user=grantee@domain lookup read"
  succeeds, and "doveadm acl get" confirms the right is stored correctly.
- "doveadm acl recalc" run for both the owner and the grantee.
- "doveadm mailbox list -u grantee@domain" (with and without an explicit
  "Shared*" pattern) shows only the grantee's own private folders - no
  Shared.<owner>.* namespace mailbox at all.
- A raw IMAP LIST via Python's imaplib as the grantee, after logging in
  normally, confirms the same: no shared mailbox listed.

Setup details:
- Dovecot 2.4.1 (Debian 13/trixie package, 1:2.4.1+dfsg1-6+deb13u6)
- Virtual users via SQL passdb/userdb (PostfixAdmin/MySQL), Maildir storage
- Shared namespace: prefix = Shared.%{owner_user | username}.
- acl plugin enabled, acl_shared_dict configured, dict entries do get
  populated correctly (checked directly against the dict backend)

So this looks like it's not (or not only) CVE-2026-40020 - something else
seems to be preventing the shared namespace from actually surfacing the
mailbox to the grantee, even with a correctly stored ACL right. Has
anyone seen this specific symptom before, or is there a known additional
step needed for SQL-based virtual users?

Happy to share the exact doveconf -n output for the relevant sections if
useful.

Thank you,
Artem Ignatov
IT Administrator, GK INVEST

_______________________________________________
dovecot mailing list -- [email protected]
To unsubscribe send an email to [email protected]