CVE-2026-61909: Cyrus IMAP CalDAV/CardDAV ACL Bypass

CVE-2026-61909 is an authentication bypass flaw in Cyrus IMAP affecting CalDAV and CardDAV implementations. Authenticated users can access unshared calendar events and contacts through multiget REPORT requests. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-61909 Overview

CVE-2026-61909 is an access control flaw in Cyrus IMAP versions prior to 3.12.4. The vulnerability affects the CalDAV and CardDAV multiget REPORT handlers, which fail to enforce per-href Access Control Lists (ACLs). An authenticated Distributed Authoring and Versioning (DAV) user with partial shared access to another user's calendar or address book can retrieve resources they were never granted access to. The attacker simply references the target hrefs inside a calendar-multiget or addressbook-multiget REPORT request. The issue is classified under [CWE-420] (Unprotected Alternate Channel).

Critical Impact
Authenticated DAV users with any shared access to a victim's calendar or address book can read unshared events and contacts, resulting in confidentiality loss for personal scheduling and contact data.

Affected Products

Cyrus IMAP versions prior to 3.8.8
Cyrus IMAP versions prior to 3.10.4
Cyrus IMAP versions prior to 3.12.4

Discovery Timeline

2026-09-09 - CVE-2026-61909 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-61909

Vulnerability Analysis

Cyrus IMAP implements CalDAV and CardDAV per RFC 4791 and RFC 6352. Both protocols expose a multiget REPORT method that allows clients to fetch multiple resources in a single request by listing their hrefs. Cyrus enforces sharing through per-collection and per-resource ACLs, so a user granted partial access to another user's calendar should only see the items explicitly shared.

The vulnerable code path processes each href in the multiget body without re-evaluating the ACL for the referenced resource. Once the request passes the collection-level authorization check, the server returns the requested items regardless of their individual sharing state. The attacker must already hold some level of shared access, which limits the attack surface but not the impact within a shared tenancy.

Root Cause

The root cause is a missing authorization check on the per-href branch of the multiget handler. The server treats the collection-level ACL as sufficient authorization for every resource enumerated in the REPORT body. Individual resource ACLs, which normally gate unshared items, are bypassed because the alternate multiget channel does not invoke them.

Attack Vector

Exploitation requires an authenticated DAV session and prior shared access to the target calendar or address book. The attacker crafts a REPORT request containing a calendar-multiget or addressbook-multiget element that lists hrefs pointing to resources the victim has not shared. The server responds with the full content of those resources, disclosing event details, attendees, contact records, and other stored properties.

No verified public exploit code is available. Refer to the Cyrus IMAP 3.12.4 Release Notes for upstream discussion of the fix.

Detection Methods for CVE-2026-61909

Indicators of Compromise

HTTP REPORT requests to /dav/calendars/ or /dav/addressbooks/ containing calendar-multiget or addressbook-multiget elements with hrefs pointing outside the requester's shared scope.
Successful 207 Multi-Status responses returning resource bodies for hrefs the requesting principal has no direct grant on.
DAV sessions issuing high-volume multiget REPORTs enumerating sequential resource hrefs across another user's collection.

Detection Strategies

Parse Cyrus httpd access logs and correlate the requesting principal with the collection owner referenced in each multiget href.
Flag REPORT requests where the number of returned resources exceeds the count of items explicitly shared with the requester.
Baseline normal multiget usage per user and alert on deviations, particularly requests that cross tenant or user boundaries.

Monitoring Recommendations

Forward Cyrus IMAP HTTP and IMAP logs to a centralized logging or SIEM platform for retention and correlation.
Enable verbose DAV logging (httpmodules: caldav carddav with debug level) during triage to capture full REPORT bodies.
Review sharing invitations and ACL changes on calendars and address books for unexpected grants that could pre-position an attacker.

How to Mitigate CVE-2026-61909

Immediate Actions Required

Upgrade Cyrus IMAP to version 3.12.4, 3.10.4, or 3.8.8, matching your current maintenance branch.
Audit CalDAV and CardDAV sharing relationships and revoke unnecessary grants that could be leveraged as a foothold.
Rotate credentials for accounts suspected of having exercised the bypass and review DAV access logs for prior abuse.

Patch Information

The Cyrus IMAP project fixed the multiget ACL bypass in versions 3.8.8, 3.10.4, and 3.12.4. See the Cyrus IMAP 3.8.8 Release Notes, Cyrus IMAP 3.10.4 Release Notes, and Cyrus IMAP 3.12.4 Release Notes for upstream release information.

Workarounds

Disable CalDAV and CardDAV modules in imapd.conf if calendar and address book sharing is not required in your deployment.
Restrict DAV sharing to trusted principals only, minimizing the population of users who meet the authenticated prerequisite.
Place the Cyrus HTTP endpoint behind a reverse proxy that can inspect and rate-limit REPORT requests until patching is complete.

bash

# Configuration example: disable DAV modules in imapd.conf if unused
httpmodules: 
# Restart Cyrus IMAP after applying configuration changes
systemctl restart cyrus-imapd