EUVD-2026-75132
GHSA-q4vc-r364-vq8w
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Pre-existing sharing grant required (AC:H); authenticated DAV user only (PR:L); read-only impact on another user's data crosses a security boundary (S:C, C:L).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.
AnalysisAI
Cyrus IMAP before 3.12.4 exposes private calendar events and contacts to partially-privileged authenticated users through a broken ACL enforcement path in the CalDAV/CardDAV multiget REPORT handler. An attacker who already holds some shared DAV access to a target user's calendar or address book can include hrefs of unshared resources in a calendar-multiget or addressbook-multiget REPORT request, causing the server to return those resources without enforcing per-href access controls. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be an authenticated Cyrus IMAP DAV user (PR:L) and must already hold some form of shared access to the target user's calendar (CalDAV) or address book (CardDAV) - for example, a free/busy grant or a partially shared sub-collection. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N yields a base score of 3.5, which accurately captures several real-world constraints. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Cyrus IMAP to the appropriate fixed release for your deployed branch: 3.12.4, 3.10.4, or 3.8.8. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-420 – Unprotected Alternate Channel
View allShare
External POC / Exploit Code
Leaving vuln.today