CVE-2026-61909

A flaw was found in cyrus-imapd. An authenticated DAV (Distributed Authoring and Versioning) user with some shared access to another user's calendar or address book could read unshared events or contacts. This information disclosure occurs by including specific resource identifiers in a calendar-multiget or addressbook-multiget REPORT, bypassing intended access controls.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce the attack surface, restrict network access to the cyrus-imapd service to trusted internal networks or localhost. This operational control can be implemented by configuring network firewalls to limit inbound connections to the service's listening port. This may impact legitimate users who require remote CalDAV/CardDAV access.