CVE-2016-4910: Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to delete o...

Security readout for executives and security teams

This issue affects Cybozu Garoon 3.0.0 through 4.2.2. An authenticated remote user could bypass access restrictions and delete another operational administrator's MultiReport filters. The cited sources do not describe data theft, code execution, or unauthenticated access, but the issue can disrupt administrative reporting controls. Exposure is likely limited to organizations running Cybozu Garoon versions 3.0.0 to 4.2.2, where untrusted or lower-trust authenticated users can reach the Garoon application. Systems outside that version range are not identified as affected in the supplied sources. Prioritize remediation for internet-accessible or broadly accessible Garoon instances. This is not presented as actively exploited or unauthenticated, but it affects administrative integrity and could disrupt reporting operations in affected deployments. Mitigation focus: Inventory Cybozu Garoon deployments and identify any versions from 3.0.0 through 4.2.2.; Check Cybozu support article 9461 for fixed versions or official workarounds.; Follow Cybozu upgrade or remediation guidance before assuming a local fix..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.