Radicale 3.8.3

Fixes (Security)

• Fix: auth: clear rights/user_groups before conditional set depending on group_type/auth_type
• credits to @d3do-23 reporting this as FO-RAD-2026-001 incl. suggestion for a fix
• Fix: [group] htgroup: fix not working htgroup_cache=True
• credits to @d3do-23 reporting this as FO-RAD-2026-002 incl. suggestion for a fix

[!TIP]

@d3do-23: Wenhao Wu, Southeast University

[!WARNING]

Related to FO-RAD-2026-001, users which are using group-membership (LDAP/PAM/htgroup] based sharings are adviced to update immediately to 3.8.3 or at least apply manually a fix and restart the server:

File: radicale/app/__init__.py

• Version >= 3.8.0 (around line 600)

+        self._rights._user_groups = set([])
         if user:
            group_type = self.configuration.get("group", "type")

• Version >= 3.3.0 && < 3.8.0 (around line 550)

+       self._rights._user_groups = set([])
        if self.configuration.get("auth", "type") == "ldap":
            try:

[!NOTE]

Updated builds for Fedora/EL are already available in "testing" and can be updated using: yum update --enablerepo updates-testing '*radicale*' (Fedora) or yum update --enablerepo epel-testing '*radicale*' (EL)