Issues

• LOW: NODE_ENV=test bypasses requireInternal; dead delegation/free-busy surface

  security
  FreeshardBase/calendar#537 · Filter by author BeSovereign opened on Oct 16, 2026

• LOW: Sync worker: stale credential-purge patterns, raw path segments, unchecked env-mode id, image hygiene

  security
  FreeshardBase/calendar#536 · Filter by author BeSovereign opened on Oct 16, 2026

• LOW: Logout ends the app session only; the IdP session re-authenticates on the next page load

  security
  FreeshardBase/calendar#535 · Filter by author BeSovereign opened on Oct 16, 2026

• LOW: Per-user calendar colour override is stored and rendered unvalidated

  security
  FreeshardBase/calendar#534 · Filter by author BeSovereign opened on Oct 16, 2026

• LOW: Attachment browser forwards the user id as a bearer token and lets the caller choose the path on the FileBrowser host

  security
  FreeshardBase/calendar#533 · Filter by author BeSovereign opened on Oct 16, 2026

• MEDIUM: Sync worker reuses stored account URLs without re-validation; redirects are followed

  security
  FreeshardBase/calendar#532 · Filter by author BeSovereign opened on Oct 16, 2026

• MEDIUM: Sync worker pairs every local calendar with every linked CalDAV server ("from a", "from b") and lets the remote server name local status paths

  security
  FreeshardBase/calendar#531 · Filter by author BeSovereign opened on Oct 16, 2026

• MEDIUM: Public booking page reads are an unauthenticated amplifier against the owner's calendars and external providers

  security
  FreeshardBase/calendar#530 · Filter by author BeSovereign opened on Oct 16, 2026

• MEDIUM: Delegation grants can be revoked by id without an ownership check

  security
  FreeshardBase/calendar#529 · Filter by author BeSovereign opened on Oct 16, 2026

• MEDIUM: Attendee PARTSTAT from remote calendars is injected unescaped into the event dialog (markup/CSS injection)

  security
  FreeshardBase/calendar#528 · Filter by author BeSovereign opened on Oct 16, 2026

• MEDIUM: Event history is readable by any member without a calendar access check

  security
  FreeshardBase/calendar#527 · Filter by author BeSovereign opened on Oct 16, 2026

• MEDIUM: Session store persists decrypted linked-account credentials and the master secret in plaintext

  security
  FreeshardBase/calendar#526 · Filter by author BeSovereign opened on Oct 16, 2026

• MEDIUM: Legacy public share links embed the account credential (including SYSTEM_SYNC_SECRET) under a separate unauthenticated cipher

  security
  FreeshardBase/calendar#525 · Filter by author BeSovereign opened on Oct 16, 2026

• HIGH: Live CalDAV requests to linked external servers follow redirects into the internal network (SSRF, response readable)

  security
  FreeshardBase/calendar#524 · Filter by author BeSovereign opened on Oct 16, 2026

• Optional: one-click video conference link (opt-in)

  FreeshardBase/calendar#521 · Filter by author BeSovereign opened on Oct 16, 2026

• Family: a shared family calendar as default

  FreeshardBase/calendar#520 · Filter by author BeSovereign opened on Oct 16, 2026

• Family: day view with members side by side

  FreeshardBase/calendar#519 · Filter by author BeSovereign opened on Oct 16, 2026

• Tasks: subtasks/checklists, priority, and due tasks visible in the calendar

  FreeshardBase/calendar#518 · Filter by author BeSovereign opened on Oct 16, 2026

• Mini month navigator and week numbers

  FreeshardBase/calendar#517 · Filter by author BeSovereign opened on Oct 16, 2026

• Time zone per event (different start and end zones)

  FreeshardBase/calendar#516 · Filter by author BeSovereign opened on Oct 16, 2026

• Duplicate an event or task, and save as a template

  FreeshardBase/calendar#515 · Filter by author BeSovereign opened on Oct 16, 2026

• Public holidays as built-in subscriptions

  FreeshardBase/calendar#514 · Filter by author BeSovereign opened on Oct 16, 2026

• Location field: address autocomplete and map preview (opt-in, no own server needed)

  FreeshardBase/calendar#512 · Filter by author BeSovereign opened on Oct 16, 2026

• Weather in day/week views from an open source (opt-in)

  FreeshardBase/calendar#513 · Filter by author BeSovereign opened on Oct 16, 2026

• PDF export: preview and settings

  FreeshardBase/calendar#511 · Filter by author BeSovereign opened on Oct 16, 2026