open-webui IDOR Vulnerability: Calendar Event Reparenting Allows Unauthorized Write Access to Other Users' Calendars

Vulnerability Overview IDOR: Calendar event re-parenting allows writing events into another user's calendar This vulnerability allows an attacker to write events into another user's calendar by reparenting calendar events. Specifically, the endpoint validates the caller's write permissions on the current calendar but fails to validate the provided in the request body. The model layer then unconditionally persists the new calendar ID. Affected Versions Affected Versions: Fixed Versions: Severity: Medium (4.3 / 10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: Low - Availability: None Remediation Upgrade to version or higher. POC Code Observed Output (Unescaped) Impact Read-Only to Write Privilege Escalation: On shared calendars, users granted read-only access can become viewers, effectively allowing them to write to the calendar. Phishing/Social Engineering: Events appear in the victim's private calendar (not as external invitations). Hover tooltips ( ) render the title and location as DOMPurify-sanitized HTML. Attackers can embed formatted links and tags (which are read when the victim hovers over them). DOMPurify prevents script execution, so this constitutes HTML injection rather than XSS. Calendar Spam/DoS: Infinite one-shot injection (the attacker loses access to the event after each move, but can repeat the process with new events).

Goal Reached Thanks to every supporter — we hit 100%!

open-webui IDOR Vulnerability: Calendar Event Reparenting Allows Unauthorized Write Access to Other Users' Calendars

More from this source