CVE-2026-61909

Cyrus IMAP versions before 3.12.4 are affected by a per-href ACL bypass in the CalDAV/CardDAV multiget functionality. An authenticated DAV user with some shared access to another user's calendar or address book can read unshared events or contacts by including the target hrefs in a calendar-multi...