# CVE-2026-68490: cPanel permission assignment information disclosure in CalDAV/CardDAV

Source: https://junglewise.ai/threats/cve-2026-68490-incorrect-permission-assignment-allows-local-users-to-obtain  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-68490 · Severity: info · Published 2026-09-23

cPanel is a web hosting control panel that manages email, calendar, and contact synchronization services. A permission configuration error allows local users with system access to view calendar and contact information belonging to other hosting accounts, potentially exposing sensitive personal and business scheduling details.

Technologies: [cPanel](https://junglewise.ai/threats/technologies/cpanel-cpanel). Vendors: [cPanel](https://junglewise.ai/threats/vendors/cpanel).

## Quick answers

**Is CVE-2026-68490 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-68490 being exploited in the wild.

**How severe is CVE-2026-68490?** Informational severity, published 23 September 2026.

**Which products and versions are affected?** cPanel <unknown>.

**Is there a fix for CVE-2026-68490?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-68490 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-68490?** Check whether you run cPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Incorrect permission assignment in cPanel's CalDAV/CardDAV implementation fails to properly isolate data between accounts. Local attackers with system-level access can enumerate and read calendar and contact data from other users' accounts without authentication. This is a classic privilege isolation failure in a multi-tenant hosting environment.

## Affected products

- cPanel cPanel <unknown>

## Timeline

- 2026-09-23: disclosed

## References

- [https://support.cpanel.net/hc/en-us/articles/43502940099991](https://support.cpanel.net/hc/en-us/articles/43502940099991)

## Related threats

- [cPanel symlink resolution race condition allows arbitrary root file write](https://junglewise.ai/threats/cve-2026-105476-improper-link-resolution-before-file-access-in-cpanel-allows)
- [cPanel NUL byte injection in calendar and contact access](https://junglewise.ai/threats/cve-2026-105475-improper-neutralization-of-a-nul-byte-in-cpanel-allows-remote)
- [cPanel privilege escalation allows arbitrary code execution](https://junglewise.ai/threats/cve-2026-87899-execution-with-unnecessary-privileges-in-cpanel-allows-remote)
- [An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API…](https://junglewise.ai/threats/cve-2025-66429-an-issue-was-discovered-in-cpanel-110-through-132-a-directory)