cyrus-imapd reports:
2019-11-18

Unauthenticated HTTP requests no longer inherit authentication from the previous request on the same connection.

CVE-2019-18928
cyrus-imapd-3.0.11.tgz