The vulnerability allows an attacker to use the IMAP SETACL command to inject the "anyone" permission into a user's dovecot‑acl file, even when imap_acl_allow_anyone is set to no. This injection causes all users to receive spam messages in their folders. Because the attacker only gains arbitrary folder spamming, there is no escalation to additional system access or data exposure. The flaw is an access control weakness that permits unauthorized modifications to ACL entries.

The affected product is Open‑Xchange's OX Dovecot Pro. No specific product version information is listed, so any installation that uses the vulnerable IMAP SETACL handling should be considered potentially affected.

The CVSS score is 3.1, indicating low severity, and the EPSS score is less than 1%, suggesting limited publicly documented exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, inferred from the use of the IMAP SETACL command over a network connection. No public exploits are known, and the impact is limited to folder spam without granting additional privileges.