CVE-2008-4578: Dovecot

Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days.

The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes.

Affected products

• Dovecot Dovecot: up to and including 1.1.3; version 0.99.13 only; version 0.99.14 only; version 1.0 only; version 1.0.2 only; version 1.0.3 only; …

Published 2008-10-15. Last modified 2026-06-16.