This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-61909 →

DEBIAN-CVE-2026-61909

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared acces...

Original description

The description as published by the source.

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 cyrus-imapd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 cyrus-imapd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 cyrus-imapd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.4-1"}]}]

References

advisory security-tracker.debian.org