cPanel EUVD-2026-85620

Requires an existing local, authenticated foothold on the affected host - specifically a low-privilege cPanel account on a multi-tenant/shared-hosting server running the CalDAV/CardDAV (CCS Calendar and Contacts) service (AV:L, PR:L). Exploitation is limited by the need for that prior account access and by the multi-account deployment model: on a single-tenant server there are no 'other accounts' to disclose. No user interaction is required (UI:N), and impact is confined to reading other accounts' calendar/contact data (confidentiality only; no integrity or availability effect).

The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N with SC:H, score 8.2) describes a local, low-complexity, low-privilege confidentiality-only flaw with a scope change to subsequent systems (other accounts' data). This is CVE-2026-68490 in cPanel's CalDAV/CardDAV (CCS / Calendar and Contacts Server) subsystem: CWE-732 incorrect permission assignment lets an already-authenticated local user read another account's calendar/contact data. Crucially, AV:L means this is NOT remotely exploitable over the network without a prior foothold - the 8.2 rating is elevated primarily by the SC:H scope/subsequent-system impact under CVSS 4.0 scoring, not by remote reachability. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Real-world priority is moderate-to-high for multi-tenant shared-hosting operators (a local unprivileged/reseller-level account harvesting other tenants' PII is a meaningful tenant-isolation breach), but it is a cross-tenant information disclosure, not RCE or privilege escalation - VI:N/VA:N confirm no integrity or availability impact. My independent CVSS 3.1 assessment (~6.5) is lower than the 8.2 because 3.1's scope model weights this less aggressively than 4.0's subsequent-system metrics.

On a shared-hosting server, an attacker who already controls one low-privilege cPanel account (e.g. a legitimately purchased or compromised hosting account) exploits the incorrect filesystem/permission assignment on the CalDAV/CardDAV data store to read the calendar and contact records belonging to other, unrelated accounts on the same server. Because the vector is local (AV:L, PR:L), the attacker needs a valid foothold on the box first; no public POC is referenced in the available data.