{"id":"CVE-2026-113349","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-113349","generatedAt":"2026-10-28T01:43:55.644Z","title":"OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events.","description":"OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user's events, including non-public ones restricted to their owner.","published":"2026-10-20T11:17:19.000Z","lastModified":"2026-10-22T22:18:03.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":5.3,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-639"],"affected":[],"epss":{"score":0.00261,"percentile":0.17724,"date":"2026-10-26","history":[{"date":"2026-10-21","score":0.00208,"percentile":0.10415}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-20T11:17:19.000Z","detail":{"score":"5.3","severity":"MEDIUM","publishedAt":"2026-10-20T11:17:19.010Z"},"summary":"New CVE, medium severity (CVSS 5.3)."}],"references":[{"url":"https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/lib/Calendar.php#L83-L150","source":"disclosure@vulncheck.com"},{"url":"https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/calendar/CalendarUI.php#L555-L585","source":"disclosure@vulncheck.com"},{"url":"https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/calendar/CalendarUI.php#L690-L712","source":"disclosure@vulncheck.com"},{"url":"https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd","source":"disclosure@vulncheck.com"},{"url":"https://github.com/opencats/OpenCATS/issues/720","source":"disclosure@vulncheck.com"},{"url":"https://github.com/opencats/OpenCATS/releases/tag/v0.10.0","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/opencats-before-0.10.0-missing-authorization-in-calendar-editevent-deleteevent","source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-113349","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}