Threats tagged 'ghsa-g4c6-r9rj-cx53'

Omnispace Agora Project versions through 26.10.0 have a vulnerability in token generation where the shared-calendar iCal share token can be predicted and forged by unauthenticated attackers. This is due to the token being derived from predictable fields such as object creation time, which is disclosed in the calendar metadata. Exploiting this allows unauthorized reading of shared calendar iCal feeds.