CVE-2026-68490

CVE-2026-68490 is an incorrect permission assignment (CWE-732) affecting the CalDAV/CardDAV calendar and address book service in cPanel & WHM, based on the related reporting naming cPanel. Any user who already has an account on the same server (for example, another shared-hosting tenant or a low-privilege local user) can access other accounts' calendar and contact data, because the service fails to enforce per-account boundaries on those resources. The attack is local, requires only low privileges, and no user interaction, yielding high confidentiality impact — including exposure of data in connected/subsequent systems per the CVSS 4.0 vector — but no integrity or availability impact. Practically, an attacker gains other tenants' calendars and address books, which frequently contain sensitive personal, corporate, and credential-adjacent information (meeting details, contacts, reset addresses). There is no CISA KEV entry and no public proof of concept, so exploitation status is currently none known.

What to do: Update cPanel & WHM to the latest release in your supported tier (Current or LTS) and check the vendor changelog for the CalDAV/CardDAV permission fix once the exact fixed build is published. Audit calendar/contact (CalDAV/CardDAV) data directories and service logs for cross-account access by non-owner accounts, since a successful abuse leaves read traces. If the calendar and contacts service is not needed on your server, disable it to eliminate this attack surface, and treat any compromised address books as potential pivot data for phishing against your tenants.