{
  "id": 20101980,
  "title": "Radicale Rights Files Define More Than Login Access",
  "url": "https://urgent.news/2026/11/15/radicale-rights-files-define-more-than-login-access",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-15T02:42:09.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ioneyrezende/radicale-rights-files-define-more-than-login-access-2k76"
  },
  "original_language": "en",
  "account": "Radicale is a server that manages calendars and address books. Authentication verifies user credentials, while the rights backend determines a user's access to specific collections. A test on November 15, 2026, revealed numerous instances of Radicale being referenced. The server's rights backend evaluates a combination of the authenticated user and the collection path to determine permissions. This means the order and coverage of rules play a crucial role in security. A broad rule may inadvertently grant access to a shared collection that the administrator intended to secure separately. The server's documentation clarifies that access to collections outside a user's individual directory is possible but not automatically discovered. To ensure comprehensive security, it is essential to review the authentication backend, rights file, public users setting, and reverse proxy. Radicale can operate independently or behind a real HTTP server, providing operators more control over TLS, headers, request limits, and access logs. Regardless of the mode, it is crucial to ensure that the externally reachable path does not bypass the intended proxy. Testing should involve creating multiple users - including an authenticated user, administrator, and revoked account - and testing their interactions with various collections using different HTTP methods. This should include checking for proper denial of access for unauthenticated requests. Collection exports and backups should also be reviewed to ensure sensitive data is properly protected. Radicale's fingerprint can be a useful identifier, but it is only the beginning of the evaluation process. The rights file, authentication backend, collection ownership, proxy configuration, and backup protection all play significant roles in determining a user's ability to access specific data.",
  "summary": "Radicale Rights Files Define More Than Login Access Radicale is a CalDAV and CardDAV server that stores calendars and address books in collections. Authentication answers whether a user knows a valid credential. The rights backend answers which collections that user may read, write, or share. A deployment that reviews only the password file has tested half of the boundary. The ZoomEye measurement…",
  "key_points": [
    "Radicale is a server managing calendars and address books.",
    "Rights backend determines user access to specific collections.",
    "Comprehensive security requires review of multiple components."
  ],
  "editors_take": "Overlapping rule configurations and complex backend dependencies turn Radicale security into a multi-layered challenge that requires administrators to audit more than just simple login credentials to prevent unauthorized data access.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}