The issue arises from the Data Access component's improper handling of multiple user accounts on the same mail server. This allows local users to bypass intended access restrictions by leveraging a different account's cookie in certain circumstances.