Steps to reproduce
Go to Administration settings -> Sharing.
Under "Limit sharing based on groups", select "Allow some groups" and restrict it to a specific group (e.g., "admin").
Under "Privacy settings for sharing", enable "Allow autocompletion to full match when entering the full name...".
Ensure that only "Also allow autocompletion on full match of the user email" is checked, while other full-match options (like User ID or Display name) are disabled.
Log in as a normal user who is NOT part of the allowed "admin" group.
Open the Calendar app, create a new event, and type single characters or letters into the "Attendees" search field.
Expected behavior
The autocomplete should NOT show any users or email addresses, because sharing is restricted to admins, and incomplete matches are forbidden. This works perfectly in the Files app.
Actual behavior
The Calendar search field completely ignores these administrative restrictions. It queries the global user database and exposes full names and email addresses to unauthorized users immediately upon typing single characters.
Calendar app version
6.5.3
CalDAV-clients used
No response
Browser
Firefox 153.0.3
Client operating system
Windows 11
Server operating system
No response
Web server
None
Database engine version
None
PHP engine version
None
Nextcloud version
34.0.2
Updated from an older installed version or fresh install
None
List of activated apps
Nextcloud configuration
Web server error log
Log file
Browser log
Additional info
No response
Steps to reproduce
Go to Administration settings -> Sharing.
Under "Limit sharing based on groups", select "Allow some groups" and restrict it to a specific group (e.g., "admin").
Under "Privacy settings for sharing", enable "Allow autocompletion to full match when entering the full name...".
Ensure that only "Also allow autocompletion on full match of the user email" is checked, while other full-match options (like User ID or Display name) are disabled.
Log in as a normal user who is NOT part of the allowed "admin" group.
Open the Calendar app, create a new event, and type single characters or letters into the "Attendees" search field.
Expected behavior
The autocomplete should NOT show any users or email addresses, because sharing is restricted to admins, and incomplete matches are forbidden. This works perfectly in the Files app.
Actual behavior
The Calendar search field completely ignores these administrative restrictions. It queries the global user database and exposes full names and email addresses to unauthorized users immediately upon typing single characters.
Calendar app version
6.5.3
CalDAV-clients used
No response
Browser
Firefox 153.0.3
Client operating system
Windows 11
Server operating system
No response
Web server
None
Database engine version
None
PHP engine version
None
Nextcloud version
34.0.2
Updated from an older installed version or fresh install
None
List of activated apps
Nextcloud configuration
Web server error log
Log file
Browser log
Additional info
No response