{"id":"CVE-2026-113349","kind":"vulnerability","aliases":["CVE-2026-113349"],"related":[],"title":"OpenCATS: authenticated users can edit or delete other users' calendar events","description":"OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user's events, including non-public ones restricted to their owner.","summary":"OpenCATS before 0.10.0 does not check ownership in its calendar edit and delete handlers, so any logged-in user can change or remove events belonging to others. An attacker with edit or delete rights can supply arbitrary event IDs to alter private calendar entries.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["opencats","package","php","self-hosted"],"not_affected_if":["opencats-0.10.0-or-later","single-user"],"how_to_check":"- Check the installed OpenCATS version in the application's version file or admin page; versions below `0.10.0` are affected.\n- Confirm whether users with EDIT or DELETE calendar access exist in the user management page.","fix":"- Upgrade OpenCATS to `0.10.0` or later.\n- Until upgraded, restrict calendar edit and delete permissions to trusted users.","status":"open","published_at":"2026-10-20T11:17:19+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:24:49+00:00","updated_at":"2026-10-25T04:24:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:24:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenCATS to `0.10.0` or later.\n- Until upgraded, restrict calendar edit and delete permissions to trusted users.","reach":"network","title":"OpenCATS: authenticated users can edit or delete other users' calendar events","impact":"medium","summary":"OpenCATS before 0.10.0 does not check ownership in its calendar edit and delete handlers, so any logged-in user can change or remove events belonging to others. An attacker with edit or delete rights can supply arbitrary event IDs to alter private calendar entries.","category":"package","nicknames":[],"who_cares":["opencats","self-hosted","php"],"confidence":0.8,"needs_auth":"yes","worst_case":"Other users' calendar events are modified or deleted, including private ones.","analyst_note":"","how_to_check":"- Check the installed OpenCATS version in the application's version file or admin page; versions below `0.10.0` are affected.\n- Confirm whether users with EDIT or DELETE calendar access exist in the user management page.","needs_analyst":false,"not_affected_if":["opencats-0.10.0-or-later","single-user"],"who_is_affected":"Self-hosted OpenCATS installations before 0.10.0 with multiple user accounts that have calendar edit or delete access. Single-user installs have little exposure to cross-user tampering.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000587,"input_tokens":3350,"output_tokens":504,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113349':14A,17A '-2026':13A,16A '0.10.0':26B,71C 'access':99C 'allow':83C 'alter':65B,106C 'arbitrari':61B,102C 'attack':53B,94C 'authent':2A,84C 'author':75C 'belong':49B 'calendar':10A,33B,67B,92C 'calendarui':78C 'chang':45B 'check':29B 'contain':72C 'cve':12A,15A 'delet':7A,36B,57B,89C,98C 'edit':5A,34B,55B,96C 'entri':68B 'event':11A,48B,62B,93C,112C 'eventid':103C 'handler':37B 'host':23B 'id':63B 'includ':113C 'log':41B 'logged-in':40B 'miss':74C 'modifi':87C 'non':115C 'non-publ':114C 'ondeleteev':81C 'one':117C 'oneditev':79C 'opencat':1A,18B,24B,69C 'other':51B 'owner':121C 'ownership':30B 'packag':19B 'php':20B 'privat':66B 'public':116C 'remov':47B,108C 'restrict':118C 'right':58B 'self':22B 'self-host':21B 'suppli':60B,101C 'user':3A,9A,43B,85C,91C,110C 'valu':104C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted OpenCATS installations before 0.10.0 with multiple user accounts that have calendar edit or delete access. Single-user installs have little exposure to cross-user tampering.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T11:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113349","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113349","severity":null,"published_at":"2026-10-20T11:17:19+00:00","modified_at":"2026-10-22T22:18:02+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}