diff --git a/inc/caldav-GET.php b/inc/caldav-GET.php
index 0a67a705..371fac30 100644
--- a/inc/caldav-GET.php
+++ b/inc/caldav-GET.php
@@ -54,6 +54,10 @@ if ( $dav_resource->HavePrivilegeTo('all', false) || $session->user_no == $resou
 else if ( $resource->class != 'PRIVATE' ) {
   $allowed = true; // but we may well obfuscate it below
   if ( ! $dav_resource->HavePrivilegeTo('DAV::read') || ( $resource->class == 'CONFIDENTIAL' && ! $request->HavePrivilegeTo('DAV::write-content') ) ) {
+    if ( $resource->caldav_type == 'VCARD' ) {
+      // Free/busy access covers calendar data only; a vCard has no busy time to show.
+      $request->DoResponse( 403, translate("Forbidden") );
+    }
     $ical = new iCalComponent( $resource->caldav_data );
     $comps = $ical->GetComponents('VTIMEZONE',false);
     $confidential = obfuscated_event($comps[0]);