OpenCATS before 0.10.0 contains a missing authorization check in the CalendarUI::onEditEvent() and onDeleteEvent() functions. Authenticated users can supply arbitrary event IDs to modify or delete any user's calendar events, including non‑public items. This flaw allows an attacker to alter or erase personal schedules and privacy information, potentially creating confusion or denial of service by removing key events. The weakness corresponds to CWE‑639, Unauthorized Modification of Data.

The vulnerability affects all released versions of OpenCATS prior to 0.10.0. The product is the OpenCATS application, as identified by the vendor and product name. No specific patch release numbers are listed, but the advisory indicates a fix in version 0.10.0.

The CVSS score of 5.3 signifies moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and possess EDIT or DELETE privileges; the exploit is straightforward by supplying any event ID. While the attack requires legitimate user credentials, the impact on the confidentiality and integrity of private user data warrants timely remediation.