CVE-2026-113349

Name of the Vulnerable Software and Affected Versions OpenCATS versions prior to 0.10.0

Description Authenticated users can modify or delete calendar events belonging to other users, including non-public events restricted to the owner. This occurs because of missing authorization in the onEditEvent() and onDeleteEvent() functions within CalendarUI. An attacker with EDIT or DELETE permissions can provide arbitrary eventID values to manipulate these events.

Recommendations Update to version 0.10.0 or later. As a temporary workaround, restrict user permissions to prevent unauthorized EDIT or DELETE access to the calendar functions.