{"id":"GHSA-x2xm-p6vq-482g","summary":"OroCalendarBundle has incorrect system calendar events visibility","details":"OroPlatform is a package that assist system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks.","aliases":["CVE-2023-32062"],"modified":"2026-09-10T03:50:08.721819113Z","published":"2023-11-27T23:29:11Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2023-11-27T23:29:11Z","nvd_published_at":"2023-11-27T22:15:07Z","cwe_ids":["CWE-284"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/oroinc/crm/security/advisories/GHSA-x2xm-p6vq-482g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32062"},{"type":"WEB","url":"https://github.com/oroinc/OroCalendarBundle/commit/460a8ffb63b10c76f2fa26d53512164851c4909b"},{"type":"WEB","url":"https://github.com/oroinc/OroCalendarBundle/commit/5f4734aa02088191c1c1d90ac0909f48610fe531"},{"type":"PACKAGE","url":"https://github.com/oroinc/crm"}],"affected":[{"package":{"name":"oro/calendar-bundle","ecosystem":"Packagist","purl":"pkg:composer/oro/calendar-bundle"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"last_affected":"4.2.6"}]}],"versions":["4.2.0","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-x2xm-p6vq-482g/GHSA-x2xm-p6vq-482g.json"}},{"package":{"name":"oro/calendar-bundle","ecosystem":"Packagist","purl":"pkg:composer/oro/calendar-bundle"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.7"}]}],"versions":["5.0.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-x2xm-p6vq-482g/GHSA-x2xm-p6vq-482g.json","last_known_affected_version_range":"\u003c= 5.0.6"}},{"package":{"name":"oro/calendar-bundle","ecosystem":"Packagist","purl":"pkg:composer/oro/calendar-bundle"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.1"}]}],"versions":["5.1.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-x2xm-p6vq-482g/GHSA-x2xm-p6vq-482g.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"}]}