The vulnerability in cyrus-imapd (Cyrus IMAP) up to version 3.12.2 arises from the vacation "fcc" feature skipping the destination mailbox Access Control List (ACL) verification. A user whose vacation Sieve script uses the :fcc action to save copies of sent messages can deliver vacation auto-reply copies into arbitrary mailboxes named in the script, regardless of whether the user has insert permissions on those mailboxes. This constitutes an incorrect authorization (CWE-863) flaw, potentially allowing unauthorized message insertion.

The impact is limited to unauthorized insertion of messages into mailboxes without proper permissions. This could lead to integrity issues where users receive unexpected or unauthorized vacation auto-reply copies in mailboxes they do not control. There is no confidentiality or availability impact reported. The CVSS score of 5.4 reflects a medium severity with low attack complexity and requiring low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is indicated in the provided data. Until a patch is available, administrators should review and possibly restrict the use of vacation Sieve scripts with the :fcc feature or monitor mailbox ACL configurations to limit exposure.