The vulnerability allows an attacker to use the IMAP SETACL command to inject the "anyone" permission into a user's dovecot-acl file, even when imap_acl_allow_anyone is set to no. This injection causes all users to receive spam messages in their folders. Because the attacker only gains arbitrary folder spamming, there is no escalation to additional system access or data exposure. The flaw is an access control weakness that permits unauthorized modifications to ACL entries.

The affected product is Open‑Xchange's OX Dovecot Pro. No specific product version information is listed, so any installation that uses the vulnerable IMAP SETACL handling should be considered potentially affected.

The CVSS score is 3.1, indicating low severity, and the EPSS score is not available, suggesting limited publicly documented exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, exploiting the IMAP SETACL command sent over a network connection. No public exploits are known, and the impact is limited to folder spam without granting additional privileges.