Incorrect access control in Meabilis CMS 1.0 allows attackers to access other users' address books via unspecified vectors.