---
id: "CVE-2026-113349"
kind: "vulnerability"
aliases: ["CVE-2026-113349"]
title: "OpenCATS: authenticated users can edit or delete other users' calendar events"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["opencats", "package", "php", "self-hosted"]
not_affected_if: ["opencats-0.10.0-or-later", "single-user"]
published_at: "2026-10-20T11:17:19+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:24:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113349", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# OpenCATS: authenticated users can edit or delete other users' calendar events

OpenCATS before 0.10.0 does not check ownership in its calendar edit and delete handlers, so any logged-in user can change or remove events belonging to others. An attacker with edit or delete rights can supply arbitrary event IDs to alter private calendar entries.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenCATS version in the application's version file or admin page; versions below `0.10.0` are affected.
- Confirm whether users with EDIT or DELETE calendar access exist in the user management page.

## Fix

- Upgrade OpenCATS to `0.10.0` or later.
- Until upgraded, restrict calendar edit and delete permissions to trusted users.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113349

## From the sources

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user's events, including non-public ones restricted to their owner.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_