Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user name, as demonstrated by .*.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Radicale | Radicale | * | 1.0.1 (including) |