Security: CVE-2026-68490 Vulnerability in cPanel's CalDAV/CardDAV Functionality - September 22, 2026

Situation

A permissions issue could allow a local user on the same server to access calendar and contact data belonging to other accounts.

Affected Product Versions

Impact

Successful exploitation allows a local user to read the calendar events and contacts of other accounts on the same server. It does not grant the ability to modify that data, and it does not grant root access.

Call to action

Update to the latest patched version: How do I update cPanel/WHM?

Updating both corrects the permissions used for new calendar and address book storage and repairs the permissions on existing accounts.

Acknowledgements

We would like to thank Ali Mustafa (rz1027) for responsibly disclosing this vulnerability.