WebCalendar v1.9.26

A security release resolving the findings of a comprehensive security audit —
55 confirmed vulnerabilities (2 critical, 12 high, 25 medium, 16 low) plus 6
validated leads. All users are strongly encouraged to upgrade. There are no
database schema changes.

Security

• Access control — enforced per-object ownership and authorization across
  event create/edit/delete, AJAX endpoints, export, reports, preferences,
  remote (nonuser) calendars, custom templates, document/blob delegation, the
  wizard POST API, and MCP write tools; fixed privilege escalation and
  cross-account (IDOR) access. (#801, #802)
• Authentication & session — replaced the pass-the-hash remember-me cookie
  with a random token stored only as a server-side hash, across the DB, LDAP,
  IMAP and NIS backends; added session-id rotation on login, SameSite and
  strict-mode session/cookie hardening, a login brute-force throttle, and
  account-lifecycle, registration and open-redirect hardening. (#801, #803)
• Cross-site scripting — escaped reflected and stored output in ajax.php,
  task names, include-src, iCal JS, HTML mail, upcoming.php and report.php;
  fixed an rss.php CDATA breakout. (#801, #802)
• SQL escaping — DB2/ODBC parameter escaping now uses ANSI quote-doubling
  instead of addslashes, which previously left a live string terminator. (#803)
• SSRF — closed an IPv4-mapped IPv6 bypass in the remote-URL guard. (#801)
• Local file inclusion / path traversal — fixed unauthenticated LFI via
  js_cacher.php, confined category-icon copying to wc-icons/, and locked down
  the custom-template subsystem. (#801)
• Information disclosure — fixed private/confidential event leaks in
  view_entry.php, upcoming.php and report.php. (#801)
• Configuration integrity — stopped request-derived SERVER_URL from being
  persisted and blocked non-admin override of system settings. (#801)
• Email — enforce STARTTLS for SMTP notification mail. (#801)
• iCalendar import — require active participation before matching an event
  by UID. (#801)
• Supply chain — pinned the release-signing GitHub Action to a commit SHA.
  (#802)

Upgrading

No database schema changes. After deploying, run wizard/index.php once to
advance the stored version (the wizard is triggered for every version bump,
even when no SQL runs).

Verifying this release

WebCalendar releases ship a signed manifest. See docs/release-signing.md for
verification instructions.