Cyrus IMAP CVE-2026-61909

The attacker must be an authenticated Cyrus IMAP DAV user (PR:L) and must already hold some form of shared access to the target user's calendar (CalDAV) or address book (CardDAV) - for example, a free/busy grant or a partially shared sub-collection. Exploitation is not possible without this pre-existing sharing relationship, which is the primary limiting factor. The attacker must also know or be able to guess/enumerate the hrefs of the specific calendar objects or contacts they wish to retrieve. The CalDAV/CardDAV service must be enabled and reachable over the network (AV:N). Exploitation is strictly read-only (C:L only); no write, administrative, or system-level access is achievable through this path. Deployments that do not use CalDAV/CardDAV sharing are not exposed.

The provided CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N yields a base score of 3.5, which accurately captures several real-world constraints. AC:H is justified because the attacker must already hold some form of sharing access to the victim's calendar or address book - exploitation is impossible without a prior sharing relationship. PR:L reflects that the attacker must be an authenticated DAV user. Impact is limited to confidentiality of calendar or contact data (C:L), with no integrity or availability consequence. The S:C scope change is meaningful - the security boundary between user accounts is crossed. No EPSS score was provided in the input; KEV status is absent, and no public exploit code has been identified. In practice, the blast radius per successful exploit is narrow: an attacker learns private calendar events or contact details of one specific victim with whom they share partial DAV access. This is a real privacy risk in environments with active calendar sharing (enterprises, academic institutions) but is far from a system-compromise scenario. The 'Authentication Bypass' tag is a mislabel - this is an authorization/ACL bypass on an alternate protocol path, not an authentication bypass.

A user who has been granted free/busy read access to a colleague's shared calendar crafts a calendar-multiget REPORT XML body containing hrefs of private appointment objects in that colleague's calendar - hrefs they may have guessed, enumerated from a previous partial disclosure, or obtained via another channel. The Cyrus IMAP server processes the multiget request without performing per-href ACL checks and returns the full iCalendar objects, exposing private meeting details, attendee lists, or sensitive notes. No public exploit code has been identified at time of analysis.