---
id: CVE-2026-113349
title: OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent
summary: >-
  OpenCATS before 0.10.0 contains a missing authorization vulnerability in
  CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users
  to modify or delete other users' calendar events. Attackers with EDIT or
  DELETE access…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: opencats
product: OpenCATS
affected:
  - OpenCATS < 0.10.0
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T10:41:36.105Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113349'
references:
  - url: 'https://github.com/opencats/OpenCATS/issues/720'
  - url: >-
      https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd
  - url: 'https://github.com/opencats/OpenCATS/releases/tag/v0.10.0'
    label: OpenCATS v0.10.0 Release Notes
  - url: >-
      https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/calendar/CalendarUI.php#L555-L585
  - url: >-
      https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/calendar/CalendarUI.php#L690-L712
  - url: >-
      https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/lib/Calendar.php#L83-L150
  - url: >-
      https://www.vulncheck.com/advisories/opencats-before-0.10.0-missing-authorization-in-calendar-editevent-deleteevent
    label: >-
      VulnCheck Advisory: OpenCATS before 0.10.0 Missing Authorization in
      Calendar editEvent/deleteEvent
tags:
  - cve.org
ingestedAt: '2026-10-20T12:05:07.326Z'
---

## Overview

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user's events, including non-public ones restricted to their owner.

## Affected

- `OpenCATS < 0.10.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.