UpHeron
All vulnerabilities

Servers and applications

CVE-2008-4577

The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.

Severity
High 7.5
Published
15 Oct 2008
Last changed
16 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.1.4
Exploit chance
2.3% in the next 30 daysHigher than 83% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
Incorrect authorization (CWE-863)
Attack
Over the network · No login needed · No user action needed
Attacker can
Read data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Sources
NVD

Affected software

SoftwareAffected versions
DovecotServers and applications · cpe:a:dovecot:dovecot
  • Every version before 1.1.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2008-4577
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2008-4577