This vulnerability in Mimecast Incydr before version 2.6.0 involves incorrect permission assignment (CWE-732) that permits arbitrary file access. The CVSS vector indicates the attack requires local access (AV:L), high attack complexity (AC:H), no privileges (PR:N), and no user interaction (UI:N), with a scope change (S:C) and limited confidentiality and integrity impact (C:L/I:L) but no availability impact (A:N). The affected version explicitly identified is 1.2.0. There is no vendor advisory or patch available at this time.

An attacker with local access could exploit this vulnerability to gain unauthorized access to arbitrary files, potentially exposing sensitive information or modifying data. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability does not require user interaction but has a high attack complexity and no privileges required, indicating some constraints on exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, users should monitor Mimecast's advisories for updates. Restrict local access to trusted users only as a precautionary measure until a patch is released.