Restriction bypass is a control failure that lets a user sidestep an intended security policy. The policy may be an access rule, a workflow limit, a file-type check, a feature gate, or a mailbox action that should only be possible for certain users or conditions. The software still runs, but it no longer enforces the boundary the defenders expected.
This matters because many attacks do not need direct code execution if they can evade the rules that protect data and functionality. In email platforms, a bypass may let an attacker reach restricted settings, access messages they should not see, trigger actions outside normal approval paths, or combine with other bugs such as XSS or SSRF to widen access. Defenders look for strong server-side authorization, consistent checks across every request path, and tests that confirm policy holds even when inputs are malformed or features are disabled. A bypass is often a sign that security logic exists, but not everywhere it should.