Loading vulnerability…
Cross-account CalDAV/CardDAV information disclosure in cPanel & WHM
CVE-2026-68490 is an incorrect permission assignment vulnerability in the CalDAV/CardDAV functionality of cPanel & WHM version 120 and later, prior to the applicable fixed builds. Unsafe permissions on calendar and address-book storage allow a low-privileged local user to read calendar events and contact information belonging to other accounts on the same server. The vulnerability breaks cross-account confidentiality but does not permit modification of the exposed records or grant root access.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation exposes other tenants' calendar events and address-book records, potentially including names, email addresses, contact details, business relationships, meeting schedules, and appointments. Shared-hosting environments are particularly affected because a malicious or compromised local account can access neighboring accounts' sensitive information. This vulnerability does not itself enable data modification, root privilege escalation, or arbitrary code execution.
If you can’t patch tonight, do this now.
No temporary workaround was specified for the vulnerable CalDAV/CardDAV functionality. Prioritize patching multi-tenant servers and review calendar and address-book activity for unexplained cross-account access. Access restrictions and monitoring do not correct the underlying storage permissions.
Patch, then assume compromise.
Upgrade cPanel & WHM to the applicable fixed build for the release tier: 11.134.0.57, 11.136.0.41, or 11.138.0.8, or a later fixed release. For WP Squared, upgrade to 11.138.1.11 or later. Apply the update through WHM's Upgrade to Latest Version function and verify the installed version afterward. The update corrects permissions for newly created calendar and address-book storage and repairs unsafe permissions on existing accounts.
No public exploits tracked yet. Mallory keeps watching.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.