Organizer can be changed by attendee

[codiq]

I was able to change organizer of event by editing attendees copy of it.

When organizer is changed on attendee copy it changes also on organizer original event. 

Is it a bug?

This may be small security problem when attendee can "steal" organizer status.

[Evert Pot]

It's true this is definitely possible. Most clients enforce the correct result of these so it never seemed like a big enough problem.

However, feel free to open a bug report for this. Definitely something we can look into in the future:

https://github.com/fruux/sabre-dav/issues/

Evert