The invited attendee can invite others to someone else's personal calendar (but in reality, he cant)

[realwps]

Steps to reproduce

1. User A invites B to an event in personal A calendar.
2. B accepts
3. B invites user C to the event.

Expected behavior

User C receives the invitation, or user B receives an error saying he cannot invite attendees

Actual behavior

User B sees that the invitation was sent, but in reality, it was not. User С doesn't know anything about this event.
Additionally, for user A, the participants remain unchanged. After some time, user B also sees that participant C is no longer in the event.

Calendar app version

5.0.9

CalDAV-clients used

No response

Browser

No response

Client operating system

No response

Server operating system

No response

Web server

None

Database engine version

None

PHP engine version

None

Nextcloud version

No response

Updated from an older installed version or fresh install

None

List of activated apps

Nextcloud configuration

Web server error log

Log file

Browser log

Additional info

In my case, if B is indeed able to invite other attendees.

[SebastianKrupinski]

Hi @realwps

This is correct behaviour, a Attendee (User B) should not be able to change the event unless they are the organizer.

But you are correct we should show display a better message that the user can not modify the event.