Live › vulnerability › CVE-2026-113349
Go to dashboardOpenCATS before 0.10.0 does not check ownership in its calendar edit and delete handlers, so any logged-in user can change or remove events belonging to others. An attacker with edit or delete rights can supply arbitrary event IDs to alter private calendar entries.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted OpenCATS installations before 0.10.0 with multiple user accounts that have calendar edit or delete access. Single-user installs have little exposure to cross-user tampering.
No product ranges from the sources yet.
0.10.0 are affected.0.10.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user's events, including non-public ones restricted to their owner.
This page as .md · .json · in your agent: get_signal("CVE-2026-113349")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.