cPanel Permissions Flaw Allows Local Users to Read Other Accounts’ Calendar Data
cPanel patched CVE-2026-68490, which lets local users on shared servers read other accounts' calendars and contacts.
cPanel patched CVE-2026-68490, an incorrect-permission issue in its CalDAV and CardDAV implementation affecting cPanel/WHM version 120 and later. A local user on a shared server can read other hosting accounts' calendar events and contacts, but cannot change that data or obtain root access. Fixed builds are 11.134.0.57, 11.136.0.41, 11.138.0.8, and WP Squared 11.138.1.11 or later; the updates also repair existing storage permissions. NVD had not assigned a CVSS score at publication, and the report does not describe observed exploitation.
- CVE-2026-68490 is an incorrect CalDAV/CardDAV permission flaw, CWE-732.
- A local user can read, but not modify, other accounts' calendars and contacts.
- Affected releases are cPanel/WHM 120 and later on shared servers.
- Fixes include 11.134.0.57, 11.136.0.41, 11.138.0.8, and WP Squared 11.138.1.11.
- NVD had not assigned a CVSS score, and in-the-wild exploitation was not reported.
- CVEs
- CVE-2026-68490
- Vendors
- cPanel
- Products
- cPanelWHMWP Squared
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-68490 | CalDAV/CardDAV Permission Flaw in cPanel Lets Local Users Read Other Accounts' Data | 8.2 | — |
From the original article
2 min read at gbhackers.com
cPanel has released patches for CVE-2026-68490, a vulnerability related to incorrect permissions in its CalDAV/CardDAV implementation. This flaw could allow a local user on a shared server to access calendar events and contacts from other hosting accounts. The issue affects cPanel/WHM version 120 and later, highlighting the risks associated with tenant isolation in shared-hosting environments.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.