High severity · published Oct 31, 2025
CVE-2025-30189
When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users
7.4
CVSS
0.6%
EPSS
No
On KEV
Description
When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users. After cached login, all subsequent logins are for same user. Install fixed version or disable caching either globally or for the impacted passdb/userdb drivers. No publicly available exploits are known.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OD
OX Dovecot Pro · Open-Xchange GmbH
through 3.1.0; through 2.4.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-30189
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-30189
documentation.open-xchange.com
https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2026/oxdc-adv-2026-0001.json
seclists.org
http://seclists.org/fulldisclosure/2025/Oct/29
www.openwall.com
http://www.openwall.com/lists/oss-security/2025/10/29/4
More from OX Dovecot Pro
9.1
CVE-2026-42007
An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents…
9.1
CVE-2026-27851
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped
8.2
CVE-2026-24031
Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin
7.5
CVE-2026-42391
An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately
7.5
CVE-2026-33605
An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating