Missing Authorization in OpenCATS Calendar Event Management
CVE-2026-113349

5.3MEDIUM

Key Information:

Vendor

Opencats

Status
Opencats
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113349?

OpenCATS versions before 0.10.0 are susceptible to a missing authorization flaw in the CalendarUI module. This vulnerability permits authenticated users with EDIT or DELETE permissions to manipulate or erase calendar events belonging to other users. By supplying arbitrary eventID values, attackers can access and change both public and non-public events, breaching user privacy and data integrity.

Affected Version(s)

OpenCATS 0 < 0.10.0

References

https://github.com/opencats/OpenCATS/issues/720
issue-tracking
https://github.com/opencats/OpenCATS/commit/aa3b414c3672f...
patch
https://github.com/opencats/OpenCATS/releases/tag/v0.10.0
release-notes

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lighthousekeeper1212
leediay153 from Viettel Post
.