CardDAV is an Internet protocol for synchronizing contact data, such as address books and user profiles, between a server and client devices. It is commonly used by phones, mail clients, and groupware systems to keep contacts consistent across multiple endpoints.
In cyber security, CardDAV matters because it often runs inside account-management or collaboration services that sit close to sensitive user data. If a CardDAV service has an authentication or authorization flaw, an attacker may be able to read, modify, or abuse contact information, and in multi-tenant platforms that can become a cross-account boundary problem. Defenders should treat CardDAV like other exposed management services: patch promptly, restrict access where possible, monitor for unusual sync activity, and verify that one user cannot reach another user’s data.