CVE-2026-113349mediumCWE-639

CVE-2026-113349: fallo de gravedad media en OpenCATS

OpenCATS before 0.10.0 Missing Authorization in Calendar editEvent/deleteEvent

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear OpenCATS

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.3%
OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user's events, including non-public ones restricted to their owner.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
opencats · OpenCATS
CVEs relacionadas — OpenCATS

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-27760CRITICALOpenCATS PHP Code Injection via installer AJAX endpointEPSS 33.0%CVE-2026-54453HIGHOpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)EPSS 0.4%CVE-2026-54454CRITICALOpenCATS: Authenticated RCE in the Import moduleEPSS 0.4%CVE-2026-115513MEDIUMOpenCATS before 0.12.0 Stored XSS via MRU Navigation PanelEPSS 0.3%CVE-2026-112787MEDIUMOpenCATS before 0.10.0 Missing Authorization in Reports Module EEO ReportsEPSS 0.3%CVE-2026-112786MEDIUMOpenCATS before 0.10.0 Missing Authorization via Import Revert ActionEPSS 0.3%