CVE-2026-113349

Deferred Deferred - Pending Action

Authenticated Calendar Event Modification in OpenCATS

Publication date: 2026-10-20

Last updated on: 2026-10-22

Assigner: VulnCheck

Description

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user's events, including non-public ones restricted to their owner.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-22

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113349

EUVD

EUVD-2026-104920

Affected Vendors & Products

Vendor	Product	Version / Range
opencats	OpenCATS	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

OpenCATS before version 0.10.0 has a missing authorization vulnerability in the calendar module. Authenticated users with EDIT or DELETE permissions can modify or delete events belonging to other users by supplying arbitrary eventID values. This includes non-public events restricted to their owners. The flaw stems from insufficient input validation in CalendarUI::onEditEvent() and onDeleteEvent().

Detection Guidance

Check OpenCATS version for versions before 0.10.0. Inspect CalendarUI.php and Calendar.php for missing authorization checks in event modification/deletion functions. Look for direct SQL query usage without parameterization in addEvent methods.

Impact Analysis

Attackers with EDIT or DELETE access could alter or remove any user's calendar events, including private ones. This could lead to data loss, unauthorized modifications, or disruption of scheduled activities. The vulnerability may also allow SQL injection if user input is improperly sanitized in related components.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR's integrity and confidentiality principles. For HIPAA, it may compromise protected health information if event data includes such details. Compliance risks include data breaches, unauthorized disclosures, and failure to protect personal or sensitive information.

Mitigation Strategies

Upgrade OpenCATS to version 0.10.0 or later. Implement strict input validation for eventID parameters. Add authorization checks in CalendarUI::onEditEvent() and onDeleteEvent() to ensure users can only modify/delete their own events.

Hi! I’m here to help you understand CVE-2026-113349. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...