CalDAV/CardDAV Multi-Get Access Issue in Cyrus IMAP

CVE-2026-61909

What is CVE-2026-61909?

A security issue in Cyrus IMAP versions prior to 3.12.4 permits a user with authenticated DAV access to bypass access control mechanisms. An authenticated user who has some shared access to another user's calendar or address book can exploit this vulnerability to view unshared events or contacts by crafting specific requests using calendar-multiget or addressbook-multiget REPORTs. This breach poses a risk to user privacy and data confidentiality, highlighting the importance of timely updates and maintaining robust access control policies.

References