CVE-2004-2577: The acl_check function in phpGroupWare 0.9.16RC2 always returns True, even when mkdir does not behave as ex...

Security readout for executives and security teams

This older phpGroupWare flaw can make an access-control check succeed when it should not. In affected conditions, remote users may read sensitive information through WebDAV from user home directories that lack .htaccess protection. The public record does not provide a CVSS score, confirmed fix, or evidence of active exploitation. Exposure is likely limited to legacy phpGroupWare 0.9.16RC2 deployments with WebDAV enabled and user home directories accessible without effective .htaccess or equivalent protections. Modern environments are exposed only if this old version or derived vulnerable code remains in service. Treat this as a legacy exposure review rather than an internet-wide emergency. Prioritize if phpGroupWare 0.9.16RC2 is still deployed, especially where WebDAV reaches user data. If not present, record as not applicable. Mitigation focus: Identify and retire any phpGroupWare 0.9.16RC2 deployments.; Check vendor or project guidance for a corrected release or advisory.; Disable or tightly restrict WebDAV exposure where not required..

Prepared

Jun 29, 2026, 16:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.