CVE-2026-68490 is a CWE-732 vulnerability in WebPros cPanel where incorrect permission assignment for critical resources enables local users with limited privileges to obtain sensitive CalDAV/CardDAV data belonging to other accounts. The vulnerability has a CVSS 4.0 base score of 8.2, indicating high severity, with attack vector local, low attack complexity, no privileges required beyond local user, no user interaction, and high impact on confidentiality. The affected versions are >=11.120.0.0 <11.134.0.57, >=11.136.0.0 <11.136.0.41, and >=11.138.0.0 <11.138.0.8. There is no indication of known exploits in the wild or cloud service involvement.

Local users with access to the system can exploit this vulnerability to access sensitive CalDAV/CardDAV information of other users, potentially leading to unauthorized disclosure of private calendar and contact data. The vulnerability does not allow privilege escalation or remote exploitation but compromises confidentiality within the local environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local user access to trusted individuals only and monitor for unauthorized access to CalDAV/CardDAV data. Avoid granting unnecessary local access privileges.