Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-61909 →

DEBIAN-CVE-2026-61909

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared acces...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 cyrus-imapd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 cyrus-imapd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 cyrus-imapd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.4-1"}]}]

Références

advisory security-tracker.debian.org