CVE-2015-8748: Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via...

Security readout for executives and security teams

This issue lets a logged-in Radicale user evade calendar or address-book ownership restrictions. A crafted username using regex metacharacters could bypass owner_write or owner_only controls, potentially allowing access beyond that user's intended collections. Exposure is limited to environments running Radicale before 1.1 with authenticated users and owner_write or owner_only authorization rules. Systems not running Radicale, or already updated to fixed vendor packages, are not indicated as exposed by the provided sources. Treat as a targeted access-control risk, not an emergency worm scenario. Prioritize patching any shared Radicale service with multiple users or sensitive calendar and contact data, especially where user accounts may be externally provisioned. Mitigation focus: Upgrade Radicale to version 1.1 or later where directly managed.; Apply fixed Debian or Fedora packages if using distribution builds.; Review vendor guidance before changing authorization behavior..

Prepared

Jun 13, 2026, 21:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.