CVE-2025-71063
Published: 12 January 2026
Summary
CVE-2025-71063 is a high-severity Improper Certificate Validation (CWE-295) vulnerability in Mrvladus Errands. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 3.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-17 (Public Key Infrastructure Certificates) and SC-8 (Transmission Confidentiality and Integrity).
Deeper analysis
CVE-2025-71063 affects the Errands application in versions prior to 46.2.10, where TLS certificates are not verified during connections to CalDAV servers. This flaw, classified under CWE-295 (Improper Certificate Validation), carries a CVSS v3.1 base score of 8.2 (High) with the vector AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L. Published on 2026-01-12, it enables potential interception of sensitive synchronization data due to missing certificate checks.
Exploitation requires an adjacent network position (AV:A) and high attack complexity (AC:H), with no privileges (PR:N) or user interaction (UI:N) needed. Attackers can achieve scope change (S:C), resulting in high confidentiality and integrity impacts (C:H/I:H) alongside low availability impact (A:L). This allows man-in-the-middle interception or modification of CalDAV traffic, compromising task data synced between the app and servers.
Advisories and patches recommend upgrading to Errands 46.2.10, which addresses the issue via commit 04e567b432083fc798ea2249363ea6c83ff01099. Key references include the Debian bug report (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1123738), GitHub issue #401 (https://github.com/mrvladus/Errands/issues/401), version comparison (https://github.com/mrvladus/Errands/compare/46.2.9...46.2.10), and the release page (https://github.com/mrvladus/Errands/releases/tag/46.2.10).
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1930
Vulnerability details
Errands before 46.2.10 does not verify TLS certificates for CalDAV servers.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper TLS certificate validation (CWE-295) directly enables active man-in-the-middle interception/modification of CalDAV traffic on an adjacent network.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and management of PKI certificates, preventing MITM attacks due to improper TLS certificate verification in Errands CalDAV connections.
Mandates timely flaw remediation by patching Errands to version 46.2.10, which fixes the TLS certificate verification failure.
Enforces cryptographic protection of transmission confidentiality and integrity, requiring proper TLS implementation with certificate validation for CalDAV sync traffic.