CVE-2026-61909

A flaw was found in cyrus-imapd. An authenticated DAV Distributed Authoring and Versioning user with some shared access to another user's calendar or address book could read unshared events or contacts. This information disclosure occurs by including specific resource identifiers in a...

CVE-2026-61909

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or...

UBUNTU-CVE-2026-61909

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or...

CVE-2026-61909

Cyrus IMAP before 3.12.4 (backported to 3.10.4 and 3.8.8) contains an ACL bypass in its CalDAV/CardDAV multiget functionality. An authenticated DAV user who holds some shared access to another user's calendar or address book can read unshared events or contacts by including target hrefs in a cale...

PT-2026-89136

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or...