cyfenced.com →

[ CVE-2026-113349 · Published 20 Oct 2026 ]

Vulnerability in OpenCATS

CVSS 4.3 EPSS <1%No fix listed yet

[ Description ]Official description

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user's events, including non-public ones restricted to their owner.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References