CVE-2026-61909

Description

A flaw was found in cyrus-imapd. An authenticated DAV (Distributed Authoring and Versioning) user with some shared access to another user's calendar or address book could read unshared events or contacts. This information disclosure occurs by including specific resource identifiers in a calendar-multiget or addressbook-multiget REPORT, bypassing intended access controls.

Mitigation

To reduce the attack surface, restrict network access to the cyrus-imapd service to trusted internal networks or localhost. This operational control can be implemented by configuring network firewalls to limit inbound connections to the service's listening port. This may impact legitimate users who require remote CalDAV/CardDAV access.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score5N/A3.5
Attack VectorNetworkN/ANetwork
Attack ComplexityLowN/AHigh
Privileges RequiredLowN/ALow
User InteractionNoneN/ANone
ScopeChangedN/AChanged
ConfidentialityLowN/ALow
Integrity ImpactNoneN/ANone
Availability ImpactNoneN/ANone

Vector

Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

Understanding the Weakness (CWE)

CWE-420

Access Control

Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.