CVE-2026-61909: Low severity Cyrus Cyrus IMAP vulnerability
An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be an authenticated DAV user and must already have some shared access to another user's calendar or address book. The issue affects access to otherwise unshared events or contacts within that shared collection.
What does an attacker need to do to retrieve unshared data?
The attacker must include the target event or contact hrefs in a CalDAV calendar-multiget REPORT or CardDAV addressbook-multiget REPORT. Exploitation is network-accessible but has high attack complexity.
Which versions are affected?
Cyrus IMAP versions before 3.12.4 are affected. The provided references also include release notes for 3.10.4, but the affected-version statement specifically identifies versions before 3.12.4.