WebCalendar v1.9.26

A security release resolving the findings of a comprehensive security audit — 55 confirmed vulnerabilities (2 critical, 12 high, 25 medium, 16 low) plus 6 validated leads. All users are strongly encouraged to upgrade. There are no database schema changes.

Security

• Access control — enforced per-object ownership and authorization across event create/edit/delete, AJAX endpoints, export, reports, preferences, remote (nonuser) calendars, custom templates, document/blob delegation, the wizard POST API, and MCP write tools; fixed privilege escalation and cross-account (IDOR) access. (#801, [#802])
• Authentication & session — replaced the pass-the-hash remember-me cookie with a random token stored only as a server-side hash, across the DB, LDAP, IMAP and NIS backends; added session-id rotation on login, SameSite and strict-mode session/cookie hardening, a login brute-force throttle, and account-lifecycle, registration and open-redirect hardening. (#801, [#803])
• Cross-site scripting — escaped reflected and stored output in ajax.php, task names, include-src, iCal JS, HTML mail, upcoming.php and report.php; fixed an rss.php CDATA breakout. (#801, [#802])
• SQL escaping — DB2/ODBC parameter escaping now uses ANSI quote-doubling instead of addslashes, which previously left a live string terminator. (#803)
• SSRF — closed an IPv4-mapped IPv6 bypass in the remote-URL guard. (#801)
• Local file inclusion / path traversal — fixed unauthenticated LFI via js_cacher.php, confined category-icon copying to wc-icons/, and locked down the custom-template subsystem. (#801)
• Information disclosure — fixed private/confidential event leaks in view_entry.php, upcoming.php and report.php. (#801)
• Configuration integrity — stopped request-derived SERVER_URL from being persisted and blocked non-admin override of system settings. (#801)
• Email — enforce STARTTLS for SMTP notification mail. (#801)
• iCalendar import — require active participation before matching an event by UID. (#801)
• Supply chain — pinned the release-signing GitHub Action to a commit SHA. (#802)

Upgrading

No database schema changes. After deploying, run wizard/index.php once to advance the stored version (the wizard is triggered for every version bump, even when no SQL runs).

Verifying this release

WebCalendar releases ship a signed manifest. See docs/release-signing.md for verification instructions.