CVE-2026-61909 in Cyrus IMAP
Summary
by MITRE • 09/09/2026
An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in Cyrus IMAP versions prior to 3.12.4 represents a critical authorization bypass within the CalDAV and CardDAV protocol implementations, specifically affecting how access control lists are evaluated during multiget operations. This flaw allows an authenticated user who possesses limited shared access rights to another user's calendar or address book to escalate their privileges beyond what is intended by the system administrator. The core of the issue lies in the handling of HTTP REPORT requests, which are standard methods for retrieving multiple resources from a CalDAV server at once. When a client issues a calendar-multiget or addressbook-multiget request, it provides a list of Uniform Resource Identifiers (URIs), known as hrefs, representing the specific events or contacts to be retrieved. The vulnerability arises because the server fails to enforce per-href access control checks for every individual resource listed in such requests.
In a properly secured implementation, each requested resource should undergo an independent authorization check against its associated Access Control List (ACL). However, due to this logical flaw, if a user has read access to even one shared calendar or address book entry within the target collection, the server may grant access to all other hrefs included in that same multiget request. This means that an attacker with minimal permissions can effectively bypass granular sharing settings by including URIs of private, unshared events or contacts alongside those they are authorized to view. The server processes the entire batch as a single operation and grants access based on the least restrictive permission found within the set, rather than evaluating each href individually against its specific ACL. This behavior fundamentally undermines the principle of least privilege and allows for unauthorized data exfiltration from private user accounts.
The operational impact of this vulnerability is significant, particularly in environments where shared calendars or address books are used extensively but strict privacy boundaries must be maintained between different users or groups. An authenticated attacker can enumerate and extract sensitive personal information, including meeting schedules, locations, contact details, and other proprietary data that was explicitly marked as private by the resource owner. This constitutes a severe breach of confidentiality and violates user expectations regarding data isolation. From an industry standard perspective, this vulnerability aligns with CWE-269, Improper Privilege Management, specifically relating to authorization bypasses where access controls are not correctly enforced for all requested resources. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, as the exploitation relies on legitimate authentication credentials combined with a logic flaw in resource-level permissions rather than an initial system compromise or credential theft.
Mitigation strategies primarily involve upgrading the Cyrus IMAP server software to version 3.12.4 or later, where this logical error has been corrected to ensure that every href within a multiget request is individually validated against its respective ACL before returning data. For organizations unable to immediately patch their systems due to operational constraints, temporary mitigations should focus on restricting network access to the CalDAV and CardDAV endpoints using firewall rules or reverse proxy configurations that limit exposure to trusted IP addresses only. Additionally, implementing strict monitoring for anomalous multiget request patterns can help detect potential exploitation attempts in real-time. It is also advisable to review existing ACL policies to ensure they are as restrictive as possible by default, minimizing the blast radius should a similar vulnerability be discovered in the future. Regular security audits and penetration testing of identity and access management configurations remain essential practices for maintaining robust defense-in-depth against such authorization bypasses.