The common cause is using symlink to web-cyradm directory in apache configuration, ie. you have
d /www/web-cyradm-0.5.4-1
l /www/web-cyradm -> /www/web-cyradm-0.5.4-1

and put "/www/web-cyradm" in httpd.conf

The guily is following piece of code in session.php

$ref=WC_BASE."/index.php";
if ($ref!=$_SERVER['SCRIPT_FILENAME']){
    header("Location: index.php");

WC_BASE is defined as
define('WC_BASE', dirname(_FILE_));

dirname gives path after referencing symlink, while _SERVER[] contains path before referencing symlink - in above case - they don't match.

This is "so called" security feature mentioned in changelog

"Added new security feature, only referer WC_BASE/index.php is allowed to call subsequent pages"

solution
- don't use symlinks
- remove the check from session.php

-email is unavailable-

HEEELP the same problem ocurre even with the last CVS version 2004/05/28

I've got the same problem
FreeBSD 4.9, MySQL 4.0, Apache2, PHP4.3.x.

Any solution ?

-email is unavailable-