Cross-user email disclosure via session-blind PDF caching

Information disclosure in OX App Suite office 8.21 and earlier allows remote authenticated users to read other users' exported email PDFs. The document converter caches exported PDFs without binding cache entries to the requesting user's session, so altered request parameters can retrieve another user's cached export. Exploitation requires an account on the same service node, precise timing before cache eviction, and modification of multiple request parameters; the reported impact is limited to reading cached email content.