Reported by 3 outlets
cPanel CalDAV/CardDAV Flaw Lets Local Users Access Other Accounts’ Contacts and Calendars
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.51 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
cPanel released patches for CVE-2026-68490 (CWE-732), an incorrect permission assignment in CalDAV and CardDAV functionality affecting cPanel and WHM version 120 and later. A local user on a shared hosting server can read calendar events and contact information from other hosting accounts. The flaw does not allow modification of the exposed data or root-level access, but it undermines tenant isolation in multi-tenant environments. The vulnerability has been assigned a CVSS score consistent with an information disclosure risk. Hosting providers should apply the security updates promptly since the attack requires only a local user account on the same server.
Timeline
-
original reporting
cPanel CalDAV/CardDAV Flaw Lets Local Users Access Other Accounts’ Contacts and Calendars
cyberpress.org · 19d ago · September 24th, 2026
cPanel has released security updates for CVE-2026-68490, a permissions vulnerability in its CalDAV and CardDAV functionality that could allow a local user on a shared server to read calendar events and contact information belonging to other hosting accounts. The flaw affects cPanel & WHM version 120 and later, making prompt patching important for hosting providers and administrators operating multi-tenant environments. The vulnerability stems from incorrect permission assignment for resources used by cPanel’s calendar and address-book services. cPanel CalDAV/CardDAV Flaw The flaw has been classified as CWE-732, “Incorrect Permission Assignment for Critical Resource,” indicating that access controls on sensitive CalDAV/CardDAV data could expose information across account boundaries. CalDAV and CardDAV are protocols used to synchronize calendars and contacts between servers and client applications. In a shared-hosting setting , weak permissions on the underlying storage can undermine tenant isolation, the core security property intended to prevent one customer account from accessing another customer’s data. According to cPanel , successful exploitation of CVE-2026-68490 enables a local user on the same server to read calendar events and contacts associated with other accounts. The issue is limited to unauthorized disclosure: it does not allow an attacker to alter exposed calendar or address-book data, and it does not provide root-level access to the affected system. Even with t
-
update from gbhackers.com
cPanel Permissions Flaw Allows Local Users to Read Other Accounts’ Calendar Data
gbhackers.com · 19d ago · September 24th, 2026
[…] The post cPanel Permissions Flaw Allows Local Users to Read Other Accounts’ Calendar Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .