CVE-2026-61909

A flaw was found in cyrus-imapd. An authenticated DAV Distributed Authoring and Versioning user with some shared access to another user's calendar or address book could read unshared events or contacts. This information disclosure occurs by including specific resource identifiers in a...

CVE-2026-61909

Cyrus IMAP versions before 3.12.4 are affected by a per-href ACL bypass in the CalDAV/CardDAV multiget functionality. An authenticated DAV user with some shared access to another user's calendar or address book can read unshared events or contacts by including the target hrefs in a calendar-multi...