CVE-2026-68490

Awaiting Analysis Awaiting Analysis - Queue

Incorrect Permission Assignment in Radicale CalDAV/CardDAV Server Leads to Information Disclosure

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: HackerOne

Description

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-68490

EUVD

EUVD-2026-85620

Affected Vendors & Products

Vendor	Product	Version / Range
cpanel	whm	From 120 (inc)
cpanel	whm	to 11.134.0.57 (inc)
cpanel	whm	to 11.136.0.41 (inc)
cpanel	whm	to 11.138.0.8 (inc)
cpanel	whm	to 11.138.1.11 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

This vulnerability is a permissions flaw in cPanel's CalDAV/CardDAV functionality. It allows a local user on the same server to access sensitive calendar and contact data belonging to other accounts without modifying the data or gaining root access.

Detection Guidance

Check cPanel/WHM version to confirm if it is affected. Use commands like 'cat /usr/local/cpanel/version' or 'whmapi1 version' to verify. Review account permissions for CalDAV/CardDAV data access. Look for unusual access patterns in logs.

Impact Analysis

If you are a cPanel user, a local attacker on your server could access your calendar and contact information, potentially exposing sensitive data. This could lead to privacy breaches or unauthorized data exposure.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security rules for protected health information. Compliance may be compromised if sensitive data is exposed.

Mitigation Strategies

Update cPanel/WHM to the latest patched version (11.134.0.57 or later, 11.136.0.41 or later, 11.138.0.8 or later, WP2: 11.138.1.11 or later). Ensure permissions for CalDAV/CardDAV data are correctly assigned for all accounts.

Hi! I’m here to help you understand CVE-2026-68490. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70