[mrl14]

I've been using Mail.app with an IMAP account for some time and always wondered why it basically loaded the entire folder structure of my web site into its folders.

Anyhow, today I finally decided to investigate, and what I found was very disturbing. I have given various people email accounts with my domain and I had complete (ie. no password) access to these accounts. they were sitting their in my folder structure and I could view the entire messages.

To me this is a huge bug. It doesn't happen in Outlook or entorouge on Mac or PC. Now I would also point out that the accout I am using is the main/default account created with the web site, and I have yet to verify how Mail handles IMAP for the extra email accounts I create, but nonetheless this is a huge security hole.

anyone confirm? agree? disagree?

[suthercd]

Need some info to comment. What server handles your IMAP account? What email server have you used to give people their own accounts? How was the security configured? What web site do you refer to in your posting?

Craig

[crazysprocket]

This sounds very much like what happens when you connect to Mac OS X Server on the IMAP admin port. Check to make sure you are using the default IMAP port (143).

[Tsilou B.]

That cannot be a Mail.app problem. The server has to prevent email clients from accessing other people's mailboxes. If it was the task of the client, someone could easily "hack" that functionality out and have access to all mailboxes.
So your server must be misconfigured or, as someone suggested, you connect to the admin port.