Repository navigation
Security: thunderbird/appointment
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
PUT /schedule/{id} omits the calendar ownership check, letting any subscriber attach a schedule to another user's calendar and, for users whose schedule is newer, take over their public booking pageGHSA-hg69-gffw-5jfx published
Oct 13, 2026 by davinotdavidModerate -
Improper Authorization - (admin-endswith)GHSA-7rrw-55cp-wmq3 published
Jul 27, 2026 by SancusHigh -
Cross-user calendar IDOR — GET /rmt/cal/{id}/… omits the ownership check its siblings perform, letting any authenticated user read another user's remote calendar eventsGHSA-25g9-pgr8-25cx published
Jun 17, 2026 by SancusModerate
Learn more about advisories related to thunderbird/appointment in the GitHub Advisory Database