CVE-2016-1220

Cybozu Garoon before 4.2.2 does not properly restrict access.