Nextcloud Server contains an authorization bypass vulnerability (CWE-639) affecting calendar access. Authenticated users with knowledge of another user's principal URL can exploit improper backend authorization to gain full read and write access to that user's calendar. This affects Nextcloud Server versions 32.0.0 up to but not including 32.0.9, and 33.0.0 up to but not including 33.0.3. The vulnerability allows unauthorized calendar data disclosure and modification. The vendor recommends upgrading to fixed versions 32.0.9 or 33.0.3, or the corresponding patched Enterprise Server versions.

An authenticated attacker can bypass authorization controls to fully access and modify another user's calendar data. This compromises confidentiality and integrity of calendar information but does not affect availability. The CVSS v3.1 score is 8.1 (high), reflecting network attack vector, low attack complexity, required privileges of an authenticated user, no user interaction, and high impact on confidentiality and integrity.

Upgrading Nextcloud Server to version 32.0.9 or 33.0.3, or the specified patched Enterprise Server versions, fully mitigates this vulnerability. No other mitigation or temporary workaround is indicated. Patch status is confirmed by vendor recommendations in the advisory.