In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.