CVE-2011-2166: script-login in Dovecot 2.0.x before 2.0.13 does not follow the user and group configuration settings, whic...

Security readout for executives and security teams

CVE-2011-2166 affects Dovecot 2.0.x before 2.0.13. The script-login component could ignore configured user and group restrictions, letting a remote authenticated user bypass intended access controls through a script. Business impact depends on whether script-login is enabled and how Dovecot is exposed. Most likely exposure is internet- or network-accessible Dovecot 2.0.x before 2.0.13 where authenticated users can reach script-login-backed services or scripts. Exposure is lower if Dovecot is newer, vendor-patched, or script-login is unused. Treat as a targeted remediation item for legacy Dovecot systems, especially externally reachable mail infrastructure. It is not supported by active-exploitation evidence in the bundle, but it can undermine access controls for authenticated users. Mitigation focus: Upgrade Dovecot to 2.0.13 or later, or install a vendor-fixed package.; Check distribution advisories for backported fixes before relying on version strings alone.; Disable or restrict script-login where it is not operationally required..

Prepared

Jun 28, 2026, 01:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.