Calendar/get reports full rights to admins on calendars that weren't shared

jcoffey-dev commented

2026-10-10 07:23:38 +00:00

Owner

When an admin opens Calendar/get on another account, every calendar comes back with full myRights, because Impersonate makes the admin a member of the whole account. So if that account shared one calendar with the admin, clients list all of its calendars as shared, including the ones that weren't.

Repro: Alice shares "Team" with Bob, who is an admin. Calendar/get on Alice's account as Bob reports full rights on her unshared default calendar too, and the webmail shows it under Alice's shared calendars.

myRights should reflect the share's ACL, not the admin override. The same per-calendar check would also let us skip the accountAccess audit record when an admin is only using a real share (that's logged now since GHSA-m992-gp7g-wc2j, which is the safe side but noisy).

When an admin opens Calendar/get on another account, every calendar comes back with full myRights, because Impersonate makes the admin a member of the whole account. So if that account shared one calendar with the admin, clients list all of its calendars as shared, including the ones that weren't. Repro: Alice shares "Team" with Bob, who is an admin. Calendar/get on Alice's account as Bob reports full rights on her unshared default calendar too, and the webmail shows it under Alice's shared calendars. myRights should reflect the share's ACL, not the admin override. The same per-calendar check would also let us skip the accountAccess audit record when an admin is only using a real share (that's logged now since GHSA-m992-gp7g-wc2j, which is the safe side but noisy).

jcoffey-dev added the bug

priority

p3

labels 2026-10-10 07:23:38 +00:00

jcoffey-dev self-assigned this 2026-10-10 07:23:38 +00:00

jcoffey-dev referenced this issue from a commit

2026-10-10 07:47:08 +00:00

Show an administrator a share as a share

jcoffey-dev referenced a pull request that will close this issue

2026-10-10 07:47:13 +00:00

Show an administrator a share as a share #187

jcoffey-dev closed this issue

2026-10-10 07:53:40 +00:00

Calendar/get reports full rights to admins on calendars that weren't shared #186