Hi Attila, hi all,
Thank you for the pointer to the Debian security tracker - confirmed independently: trixie (security) dovecot-core 1:2.4.1+dfsg1-6+deb13u6 is listed as fixed for CVE-2026-40020 (DSA-6313-1), and that is exactly the version we have installed. Good to know we don't need to touch the packaging for that.
However, this raises a separate question. We had a long-standing, unrelated problem we suspected might share the same root cause: legitimate ACL-based mailbox sharing (granting a user read access to another user's mailbox via "doveadm acl set ... lookup read") does not work for us - the shared mailbox simply never appears for the grantee, neither through "doveadm mailbox list" nor through a real IMAP LIST command.
We just re-tested this live, now that the CVE fix is confirmed present:
- "doveadm acl set -u owner@domain INBOX user=grantee@domain lookup read" succeeds, and "doveadm acl get" confirms the right is stored correctly.
- "doveadm acl recalc" run for both the owner and the grantee.
- "doveadm mailbox list -u grantee@domain" (with and without an explicit "Shared*" pattern) shows only the grantee's own private folders - no Shared.<owner>.* namespace mailbox at all.
- A raw IMAP LIST via Python's imaplib as the grantee, after logging in normally, confirms the same: no shared mailbox listed.
Setup details:
- Dovecot 2.4.1 (Debian 13/trixie package, 1:2.4.1+dfsg1-6+deb13u6)
- Virtual users via SQL passdb/userdb (PostfixAdmin/MySQL), Maildir storage
- Shared namespace: prefix = Shared.%{owner_user | username}.
- acl plugin enabled, acl_shared_dict configured, dict entries do get populated correctly (checked directly against the dict backend)
So this looks like it's not (or not only) CVE-2026-40020 - something else seems to be preventing the shared namespace from actually surfacing the mailbox to the grantee, even with a correctly stored ACL right. Has anyone seen this specific symptom before, or is there a known additional step needed for SQL-based virtual users?
Happy to share the exact doveconf -n output for the relevant sections if useful.
Thank you, Artem Ignatov IT Administrator, GK INVEST