The vulnerability arises from an incorrect permission assignment that allows a local user to fetch sensitive CalDAV and CardDAV data belonging to other accounts. This flaw effectively elevates the privileges of the local user, granting unauthorized read access to private user data stored in those protocols.

The affected product is WebPros cPanel. No specific version information is provided in the data; any deployment of the product that includes CalDAV/CardDAV support may be susceptible.

The high severity CVSS score of 8.2 indicates significant impact if exploited. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; the flaw requires that an attacker already has a local user account or has executed code with local privileges to read the incorrectly protected files. Once accessed, the attacker can read other users’ calendar and address book information, potentially using that data for further compromise.