PT-2026-89136

CVE-2026-61909

Published

2026-09-09

Updated

2026-10-02

Description by

CVSS 3.1

4.3

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cyrus IMAP versions prior to 3.12.4

Description An issue exists where CalDAV and CardDAV multiget operations bypass per-href Access Control Lists (ACL). An authenticated DAV user who has partial shared access to another user's address book or calendar can read unshared contacts or events by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.

Recommendations Update to version 3.12.4.

Exploitability

Exploit

Fix

Vendors

Affected products

Weakness enumeration

CWE-420: Unprotected Alternate Channel

Related identifiers

CVE-2026-61909

CLSA-2026-1790173408

CLSA-2026-1790974923