This vulnerability allows an attacker with limited privileges to manipulate access control lists by injecting the 'anyone' permission via the IMAP SETACL command in OX Dovecot Pro. Despite the configuration setting intended to prevent this (imap_acl_allow_anyone=no), the attacker can bypass it, causing folders to be spammed to all users. The impact is limited to spamming and does not include unauthorized data access or modification. The CVSS 3.1 score is 3.1 (low), reflecting the limited impact and the requirement for network access with low privileges and high attack complexity. No official patch or remediation level is provided in the available data, and no known exploits exist in the wild.

The vulnerability allows attackers to spam folders to all users by injecting the 'anyone' permission into ACL files. There is no unauthorized data access or integrity compromise. The impact is limited to nuisance and potential disruption caused by spammed folders. No known exploitation in the wild has been reported.

The vendor advisory does not specify an official patch or remediation level. Users should monitor vendor communications for updates and apply any forthcoming patches promptly. Since the vulnerability requires the IMAP SETACL command and specific conditions, restricting access to IMAP services and reviewing ACL configurations may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.