CVE-2021-37845

An issue was discovered in Citadel through webcit-932. A
meddler-in-the-middle attacker can fixate their own session during the
cleartext phase before a STARTTLS command (a violation of “The STARTTLS
command is only valid in non-authenticated state.” in RFC2595). This
potentially allows an attacker to cause a victim’s e-mail messages to be
stored into an attacker’s IMAP mailbox, but depends on details of the
victim’s client behavior.