Vulnerability · Published Oct 20, 2026 · Assigned by VulnCheck

CVE-2026-113349OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in OpenCATS from opencats. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 82.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user's events, including non-public ones restricted to their owner.

Affected products (as reported)

Vendor	Product	Versions
opencats	OpenCATS	0 – before 0.10.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/opencats/OpenCATS/issues/720 issue-tracking
https://github.com/opencats/OpenCATS/commit/aa3b414c3672f5010ca26c44192aa8e72d3735bd patch
OpenCATS v0.10.0 Release Notes release-notes
https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/calendar/CalendarUI.php#L555-L585 technical-description
https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/modules/calendar/CalendarUI.php#L690-L712 technical-description
https://github.com/opencats/OpenCATS/blob/5781f41814f09493c7ce05b9251b5e09c1aff0cd/lib/Calendar.php#L83-L150 technical-description
VulnCheck Advisory: OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent third-party-advisory