Radicale Rights Files Define More Than Login Access

Radicale is a server that manages calendars and address books. Authentication verifies user credentials, while the rights backend determines a user's access to specific collections. A test on November 15, 2026, revealed numerous instances of Radicale being referenced. The server's rights backend evaluates a combination of the authenticated user and the collection path to determine permissions.

This means the order and coverage of rules play a crucial role in security. A broad rule may inadvertently grant access to a shared collection that the administrator intended to secure separately. The server's documentation clarifies that access to collections outside a user's individual directory is possible but not automatically discovered.

To ensure comprehensive security, it is essential to review the authentication backend, rights file, public users setting, and reverse proxy. Radicale can operate independently or behind a real HTTP server, providing operators more control over TLS, headers, request limits, and access logs. Regardless of the mode, it is crucial to ensure that the externally reachable path does not bypass the intended proxy.

Testing should involve creating multiple users - including an authenticated user, administrator, and revoked account - and testing their interactions with various collections using different HTTP methods. This should include checking for proper denial of access for unauthenticated requests. Collection exports and backups should also be reviewed to ensure sensitive data is properly protected.

Radicale's fingerprint can be a useful identifier, but it is only the beginning of the evaluation process. The rights file, authentication backend, collection ownership, proxy configuration, and backup protection all play significant roles in determining a user's ability to access specific data.