CVE-2026-68490 cPanel CVE debrief

Who should care

System administrators and security teams responsible for cPanel/WHM servers, particularly those with multiple local users or shared hosting environments, should be aware of this vulnerability. They need to verify the current cPanel/WHM version and update to the latest patched version to prevent local users from accessing sensitive calendar and contact data of other accounts. Additionally, they should review compensating controls and monitor for suspicious

Why it matters

A permissions issue in cPanel's CalDAV/CardDAV functionality could allow a local user on the same server to access calendar and contact data belonging to other accounts, requiring verification of permissions and updating to patched versions.

• Local users may be able to access sensitive calendar and contact data of other accounts
• Requires verification of permissions on existing accounts and updating to patched versions
• May require monitoring for suspicious access to calendar and contact data

Technical summary

A permissions issue in cPanel's CalDAV/CardDAV functionality could allow a local user on the same server to access calendar and contact data belonging to other accounts. The issue affects cPanel/WHM versions 120 and up, and has been patched in versions 11.134.0.57 or later, 11.136.0.41 or later, 11.138.0.8 or later, and WP2: 11.138.1.11 or later. Successful exploitation allows a local user to read calendar events and contacts of other accounts on the same server, but does not grant the ability to modify that data or root access. This issue requires verification of permissions on existing accounts and updating to patched versions.

Defensive priority

Apply patches to correct permissions issue in cPanel's CalDAV/CardDAV functionality

Recommended defensive actions

• Update cPanel/WHM to the latest patched version (11.134.0.57 or later, 11.136.0.41 or later, 11.138.0.8 or later, or WP2: 11.138.1.11 or later)
• Verify permissions on existing accounts and correct as necessary
• Monitor for local users accessing calendar and contact data of other accounts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and vendor source item provide details on the permissions issue in cPanel's CalDAV/CardDAV functionality. The issue affects cPanel/WHM versions 120 and up. Successful exploitation allows a local user to read calendar events and contacts of other accounts on the same server. However, it does not grant the ability to modify that data or root access. To verify, defenders should check the current cPanel/WHM version and compare it with the patched versions: 11.134.0.57 or later, 11.136.0.41 or later, 11.138.0.8 or later, and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.