PT-2026-89136
CVE-2026-61909
·
تاريخ النشر
2026-09-09
·
تاريخ التحديث
2026-10-02
الوصف من
CVSS 3.1
4.3
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Cyrus IMAP versions prior to 3.12.4
Description
An issue exists where CalDAV and CardDAV multiget operations bypass per-href Access Control Lists (ACL). An authenticated DAV user who has partial shared access to another user's address book or calendar can read unshared contacts or events by including the target hrefs in a
calendar-multiget or addressbook-multiget REPORT.Recommendations
Update to version 3.12.4.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾