CVE-2026-113349 — OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent
OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other …
Published: 2026-10-20 · CVSS: 5.3 · CVSS 4.0
OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user's events, including non-public ones restricted to their owner.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7