HexBrain

Nextcloud · Report #439828

Event privacy level does not work in Thunderbird

Validstatus
mediumseverity
6upvotes
1 Mar 2020disclosed

How it was found

Events in shared calendar with changed privacy level to any other than public are shown in Thunderbird as public anyway (with all details) How to reproduce: 1 - create an event in user A's calendar shared to user B 2 - change privacy setting of this event to any other than public 3 - open Thunderbird as user B 4 - connect to user A's calendar 5 - behold the test event show as public with all details, not "Busy" brick for "show only busy" or nothing for "private"

Impact

Thunderbird user with read access can see all events with all details despite restrictions and thus can get some private info.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original