Search: CVE-2026-61909

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Low	3.5	EPSS 0.2%	CVE-2026-61909cyrusimap Cyrus IMAP · Unprotected Alternate Channel Low3.5EPSS 0.2%2026-09-09CVE Database V5CVE-2026-61909 CVE-2026-61909 is a medium severity vulnerability in Cyrus IMAP before version 3.12.4. It involves a CalDAV/CardDAV multiget operation bypassing per-href access control lists (ACLs). An authenticated DAV user with some shared access to another user's calendar or address book could read unshared events or contacts by including target hrefs in a calendar-multiget or addressbook-multiget REPORT. EPSS 0.2%Vulnerability CWE-420	CVE Database V5	2026-09-09

Page 1 of 1