Re: Safe upgrade path from 2.4.1 to 2.4.4 (CVE-2026-40020) on Debian 13

   Hi!

   When upgrading from 2.4.1 to 2.4.4 there are no stops required. Remember
   to change config_version after upgrade to get new defaults.

   You can find latest packages from [1]https://repo.dovecot.org

   Aki



     On 21/08/2026 22:29 EEST Artem Ignatov via dovecot
     <[2][email protected]> wrote:


     Hi Attila, hi all,

     Thank you for the pointer to the Debian security tracker - confirmed
     independently: trixie (security) dovecot-core 1:2.4.1+dfsg1-6+deb13u6 is
     listed as fixed for CVE-2026-40020 (DSA-6313-1), and that is exactly the
     version we have installed. Good to know we don't need to touch the
     packaging for that.

     However, this raises a separate question. We had a long-standing,
     unrelated problem we suspected might share the same root cause:
     legitimate ACL-based mailbox sharing (granting a user read access to
     another user's mailbox via "doveadm acl set ... lookup read") does not
     work for us - the shared mailbox simply never appears for the grantee,
     neither through "doveadm mailbox list" nor through a real IMAP LIST
     command.

     We just re-tested this live, now that the CVE fix is confirmed present:

     - "doveadm acl set -u owner@domain INBOX user=grantee@domain lookup
     read"
     succeeds, and "doveadm acl get" confirms the right is stored correctly.
     - "doveadm acl recalc" run for both the owner and the grantee.
     - "doveadm mailbox list -u grantee@domain" (with and without an explicit
     "Shared*" pattern) shows only the grantee's own private folders - no
     Shared.<owner>.* namespace mailbox at all.
     - A raw IMAP LIST via Python's imaplib as the grantee, after logging in
     normally, confirms the same: no shared mailbox listed.

     Setup details:
     - Dovecot 2.4.1 (Debian 13/trixie package, 1:2.4.1+dfsg1-6+deb13u6)
     - Virtual users via SQL passdb/userdb (PostfixAdmin/MySQL), Maildir
     storage
     - Shared namespace: prefix = Shared.%{owner_user | username}.
     - acl plugin enabled, acl_shared_dict configured, dict entries do get
     populated correctly (checked directly against the dict backend)

     So this looks like it's not (or not only) CVE-2026-40020 - something
     else
     seems to be preventing the shared namespace from actually surfacing the
     mailbox to the grantee, even with a correctly stored ACL right. Has
     anyone seen this specific symptom before, or is there a known additional
     step needed for SQL-based virtual users?

     Happy to share the exact doveconf -n output for the relevant sections if
     useful.

     Thank you,
     Artem Ignatov
     IT Administrator, GK INVEST

     _______________________________________________
     dovecot mailing list -- [3][email protected]
     To unsubscribe send an email to [4][email protected]

References

   Visible links
   1. https://repo.dovecot.org/
   2. mailto:[email protected]
   3. mailto:[email protected]
   4. mailto:[email protected]
_______________________________________________
dovecot mailing list -- [email protected]
To unsubscribe send an email to [email protected]