Description

An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-09T20:18:36.523Z",
  "pubdate": "2026-09-09T20:18:36.523Z",
  "executiveSummary": "A critical access control vulnerability exists in Cyrus IMAP versions prior to 3.12.4, specifically within the CalDAV and CardDAV REPORT handling mechanisms. The vulnerability allows an authenticated user, who possesses limited shared access to a target's calendar or address book, to circumvent established per-href Access Control Lists (ACLs).\nBy manipulating requests sent to the calendar-multiget or addressbook-multiget endpoints, an attacker can coerce the server into returning sensitive data—such as private calendar events or contact details—that should otherwise be restricted based on existing permission constraints. The risk is significant as it permits unauthorized information disclosure of private PIM (Personal Information Management) data. Exploitation requires the attacker to have at least partial, legitimate access to a target's shared DAV resources, which provides the necessary context to submit specifically crafted multiget requests. This flaw effectively negates the security boundaries intended by per-resource ACLs within the Cyrus IMAP DAV implementation.",
  "technicalDetails": "The vulnerability resides in the request processing logic of the CalDAV and CardDAV REPORT methods within Cyrus IMAP. Specifically, the issue manifests when the server processes multiget requests, which allow clients to retrieve multiple resources defined by a set of hrefs in a single operation. The root cause is a failure in the authorization check logic, which improperly validates access permissions on a per-resource basis when these resources are requested via a batch REPORT operation.\nUnder normal operating conditions, Cyrus IMAP applies fine-grained ACLs to determine if an authenticated principal has the required privileges to read specific resources (e.g., individual calendar events or address book cards). However, when the multiget functionality is invoked, the application logic fails to re-verify the ACL state for every individual href provided in the request body. Instead, it relies on the initial context of the shared collection access, erroneously assuming that if a user has access to a parent collection, they are implicitly authorized to view any resource included within the multiget request.\nThe attack flow is characterized as follows: 1. The attacker authenticates to the Cyrus IMAP server using valid credentials. 2. The attacker identifies a target calendar or address book collection for which they have partial, shared access (e.g., read-only access to specific public items). 3. The attacker crafts a standard CalDAV 'calendar-multiget' or CardDAV 'addressbook-multiget' REPORT request. 4. Within this request, the attacker includes a list of target hrefs corresponding to private, unshared items located within the target's collection. 5. Upon receipt, the Cyrus IMAP server processes the request but fails to enforce ACL checks against each individual private href included in the XML payload. 6. The server responds with the contents of the restricted resources, thereby exposing unauthorized PIM data.\nThis vulnerability is restricted to authenticated DAV users and requires the attacker to be part of the user's shared access ecosystem. It does not allow for cross-account exploitation without prior shared permissions. Post-exploitation, an attacker can enumerate private events, sensitive contact information, and potentially other PIM metadata that resides within the targeted collection, leading to significant information leakage."
}