{"action":"Upgrade radicale to 1.1 or later.","affected":[{"fixed":"1.1","introduced":"0"}],"component":"radicale","cve_ids":["CVE-2015-8748"],"ecosystem":"PyPI","epss":0.02281,"exploited":false,"fixed_versions":["1.1"],"ghsa_id":"GHSA-6w8c-6jrg-qwj2","id":"tcs_01M5KG6XTAVSZ8WBVJ3GMJJYT7","modified_at":"2026-06-10T17:01:49.002822804Z","published_at":"2016-02-03T18:59:00Z","references":["https://osv.dev/vulnerability/PYSEC-2016-37","https://github.com/Unrud/Radicale/commit/4bfe7c9f7991d534c8b9fbe153af9d341f925f98","http://www.debian.org/security/2016/dsa-3462","http://www.openwall.com/lists/oss-security/2016/01/05/7","https://github.com/Kozea/Radicale/pull/341","http://www.openwall.com/lists/oss-security/2016/01/06/4","http://www.securityfocus.com/bid/80255","http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175776.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175738.html","https://pypi.org/project/radicale","https://nvd.nist.gov/vuln/detail/CVE-2015-8748","https://github.com/advisories/GHSA-6w8c-6jrg-qwj2"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2016-37","url":"https://osv.dev/vulnerability/PYSEC-2016-37"},{"source":"nvd","source_id":"CVE-2015-8748","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8748"}],"summary":"Radicale before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations via regex metacharacters in the user name, as demonstrated by \".*\"."}