CVE-2016-1196: Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended access restrict...

Security readout for executives and security teams

Cybozu Garoon could expose sensitive Address Book information to a signed-in user who should not have access. The business risk is unauthorized contact or directory data disclosure, mainly from insiders or compromised accounts, not anonymous internet attackers. Exposure is limited to organizations running Cybozu Garoon 3.x or 4.x earlier than 4.2.1. The attacker must already be authenticated, so risk depends on account compromise, user population, and Address Book sensitivity. Treat this as a moderate-priority legacy application data exposure issue. Prioritize remediation if Garoon stores sensitive contacts, external directories, or employee information, especially in environments with many users or weak account controls. Mitigation focus: Upgrade affected Garoon deployments to version 4.2.1 or later.; Review the Cybozu support advisory for vendor-specific remediation guidance.; Limit Garoon access to trusted users and networks where practical..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.