OpenCATS CVE-2026-113349

Requires an authenticated OpenCATS account holding at least EDIT or DELETE access level for calendar/activity functions (PR:L); the attacker then supplies arbitrary eventID values to the onEditEvent()/onDeleteEvent() handlers, which pre-0.10.0 perform no ownership check against the event's entered_by owner. Limiting factors: exploitation is confined to authenticated users within the same site/tenant (the fix still scopes queries by site_id), no administrator/SA privilege is needed, and impact is restricted to calendar event tampering/deletion rather than broader data or system compromise. Works against default configurations of OpenCATS before 0.10.0.

This is a genuine but low-to-moderate priority issue, consistent with its CVSS 4.0 score of 5.3 (Medium). The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N shows the realistic shape of the flaw: network-reachable and low-complexity, but requiring low-privilege authentication (PR:L) and yielding only limited integrity impact (VI:L) with no confidentiality or availability impact and no scope change. This is a classic CWE-639 (IDOR / missing authorization) against calendar objects, not a system-compromise bug. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no public exploit code was supplied in the intelligence, so this is not active-exploitation-driven urgency. The main factor elevating it slightly above pure theory is that the fix is trivial and the preconditions are modest (any user with EDIT/DELETE access). One discrepancy to verify: the Tags label this 'Authentication Bypass', but the CWE (CWE-639), the description, and the patch all describe an AUTHORIZATION flaw affecting already-authenticated users - horizontal privilege abuse, not an authentication bypass.

A legitimate OpenCATS recruiter account holder with EDIT or DELETE access to activities/calendar manipulates the eventID parameter sent to the edit/delete calendar endpoints, substituting IDs belonging to other users. Because the pre-patch onEditEvent()/onDeleteEvent() code never verified that the event's 'entered_by' owner matched the requesting user, the attacker can tamper with or destroy colleagues' calendar events, including private ones. No public proof-of-concept was provided, but the fix commit and vulnerable source lines are public, making a working exploit trivial to derive.