Debian Security Advisory 1507-1 – Peter Paul Elfferich discovered that turba2, a contact management component for horde framework did not correctly check access rights before allowing users to edit addresses. This could result in valid users being able to alter private address records.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/63972/dsa-1507-1.txt
Source: https://packetstormsecurity.com/files/63972/Debian-Linux-Security-Advisory-1507-1.html