CVE-2026-113349: OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent
OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user's events, including non-public ones restricted to their owner.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenCATSto a version that resolves this vulnerability.Fixed in 0.10.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated OpenCATS user who has EDIT or DELETE access can exploit it. The attacker does not need the target event to be public or owned by them.
What access and input are required to exploit it?
The attacker needs an authenticated account with the relevant EDIT or DELETE permission and must be able to supply an arbitrary eventID value to the calendar edit or delete operation.
Are private calendar events affected?
Yes. Events restricted to their owner can be modified or deleted by an authorized attacker using another user's eventID.
Which versions are affected?
OpenCATS versions before 0.10.0 are affected. Version 0.10.0 is identified as the release containing the fix.