cPanel fixes calendar permissions flaw affecting shared servers

cPanel has issued security updates for a high-severity permissions vulnerability that could allow a local user on a shared server to read calendar events and contact information belonging to other hosting accounts.

The flaw, tracked as CVE-2026-68490, affects cPanel and WHM version 120 and later. cPanel said the problem stemmed from incorrect permissions in its CalDAV and CardDAV functionality, creating a route for one local account holder to obtain sensitive information stored for other accounts on the same machine.

The company released patched builds across supported branches, including versions 11.134.0.57, 11.136.0.41 and 11.138.0.8 or later, along with WP Squared version 11.138.1.11 or later. Administrators have been urged to update systems to the latest patched release.

cPanel said successful exploitation is limited to reading calendar events and contacts. The vulnerability does not permit an attacker to alter the exposed information and does not provide root access to the server. Even so, the weakness has been assigned a CVSS 4.0 score of 8.2, placing it in the high-severity category because of its potential impact on confidentiality across account boundaries.

The vulnerability is classified as CWE-732, or incorrect permission assignment for a critical resource. The published scoring describes a local attack vector with low attack complexity and no user interaction, while indicating high confidentiality impact. The issue therefore matters most in multi-user hosting environments where separate customers or tenants operate on the same server.

The affected CalDAV and CardDAV functions are handled through cPanel’s cpdavd service. Beginning with cPanel and WHM version 120, the company removed its older Calendar and Contacts Server plugin and moved calendar and contacts support into cpdavd. The service allows users to manage calendars, address books and task collections and to connect compatible applications through the standard CalDAV and CardDAV protocols.

cPanel said installing the updates corrects permissions applied to newly created calendar and address-book storage and also repairs the permissions on existing accounts. That distinction is important for administrators because updating is intended not only to prevent the flawed settings from being created again but also to fix data already stored under vulnerable permissions.

The company credited security researcher Ali Mustafa, who uses the handle rz1027, with responsibly disclosing the flaw. The CVE record was published on September 23, a day after cPanel issued its security advisory and patched versions.

CVE-2026-68490 was disclosed alongside another vulnerability affecting the same CalDAV and CardDAV area, CVE-2026-87899. That separate issue allows an authenticated cPanel account holder to escalate privileges and execute code as the root user, according to cPanel. It carries a higher severity and is addressed by the same patched cPanel and WHM builds.

For hosting providers, the permissions flaw highlights the security dependence of shared-server environments on strict separation between accounts. Multiple customers can use the same underlying system while expecting files, mail, calendars and other private data associated with each account to remain inaccessible to neighbouring users.

The practical exposure depends on an attacker already having local access to the server, distinguishing the flaw from vulnerabilities exploited anonymously over the internet. On shared hosting, however, local access is normal for many customers because accounts may run applications, scripts or command-line processes under their own identities. A permissions mistake can therefore undermine the isolation expected between separate tenants. The CVSS assessment reflects that combination: exploitation requires local privileges, but a successful attack can disclose information outside the attacker’s own security boundary. The published record assigns no integrity or availability impact to CVE-2026-68490, consistent with cPanel’s statement that exposed data can be read but not changed.

CalDAV and CardDAV are widely used standards for synchronising calendars and contacts between servers and client applications. cPanel’s implementation can be reached through service subdomains or dedicated ports, with secure access commonly provided over port 2080. Users can connect supported clients such as Thunderbird and Apple devices using credentials tied to their webmail accounts.