Google Calendar bug

Put an email addresses in an event title? They'll be automatically invited

A minor bug potentially embarrassing bug in Google Calendar could lead to private events being revealed to third parties. Researcher Terence Eden discovered discovered that placing a Gmail address in an event title leads to that person being automatically invited to the event, regardless of the context. It's not hard to imagine how this might lead to a few red faces through supposedly private info being released to third parties. Eden uses his wife as an example —

"My wife likes to set reminders for herself in Google Calendar. Recently, she added a note to her personal Google Calendar reading "Email to discuss pay rise" and set the date for a few months from now. She'd had a discussion with her boss, Alice, and they'd agreed to talk about salary later in the year.

A few moments later, Alice sent her a "Meeting Accepted" email."

We've confirmed the issue ourselves, and noted that it adds the event to the other person's calendar even if you choose not to send invitations to guests. The glitch seems to be a result of Google's event parsing features misfiring, assuming that each email address in the event title was an invited guest.

Eden's initial disclosure of the issue to Google was met with a response saying the feature was working as intended, however The Verge is now reporting that the company is already at work on a fix, so hopefully this won't be a problem for much longer.

In the meantime, you'll want to think twice before adding email addresses to your Google Calendar events, if that's something you were inclined to do in the first place. 

Source: Terence Eden; via: The Verge


Reader comments

Google Calendar bug could bring uninvited guests to your events


How is this a bug? It does exactly as expected if you put an email address in. Besides, who puts email addresses in the what field anyway? This is much ado about less than nothing. Next people will call it bug when you call someone and they actually answer!

Treat people as people and call them by their name instead of their email address and you'll be fine.

Agreed 100%. Is this really news? And still no article about King trying to trademark "candy" or going after other companies for using "saga" in the name of their games?

I could think of a reason to do it.

I have put in calendar things like that. Mostly because I wanted the title to remind me the email address to email. Not anything else. No need to go into discription.

The other thing that could happen is sometime when you type in names google will just fill in the email address.

I'm always using Google calendar for reminders. If I set a reminder for myself to email or call someone on a certain date & time I would include their email & phone# in my reminder but I think I always put it in the description field instead of the title field.
Anyways, Thanks for the heads up.

Posted via Android Central App

This is such a nonissue it isn't even funny. I am glad you guys are clearing things up, but the coverage it is getting is silly.

"Put an email addresses?" Sounds funny to me.

Back to the issue, looks more like a personal mistake than a bug. What bug automatically sends an email to the recipient?

This message was brought to you by the numbers 0 and 1

This sounds like "user error" in placing the email address in the subject line in the first place.

I would suggest an app like Google Keep (I use it all the time), which allows users to add reminders, if there is something that needs to be done at a later time/date.

How is this a user error? And if so why didn't Google prevent it? I expect people I invite to receive invites not anyone else whose email may be in subject lines, descriptions or anywhere else.

Alex, thanks for pointing out these bugs (1) It sends the invite & (2) It sends it even if you aren't sending invites, obviously Google have accepted these as bugs and hopefully this will be fixed soon.

"How this a user error?" I suspect that there was no intention to add the email address to the subject line when the stated intent was clearly to be a simple reminder.

How long has Google had a calendar and yet this issue has not been raised until now? How long has this user been using the calendar to add reminders (it appears to not be the first time)? However, it's probably safe to infer from the statement this was the first time she ever had this happen.

I'd bet she never intended to add the email address, and so that was a mistake. Thus my original thought is still valid..."user error."

Of course it's not user error. I'm not saying it's a serious bug or that it's a bug at all but it is crazy behaviour of the app nonetheless. If someone wants to add a calendar entry to remind themselves to email an address (could belong to a person, could be a home automation system, could be a competition, whatever) by using just the subject heading for all the details, then who would seriously expect that just putting the email address within the subject heading would trigger an email to that address at that moment when a) the subject field is not an address field b) the settings said explicitly not to send invites to attendees (not that any were added). The most widely used (I assume) email client in the world, MS Outlook, doesn't do this so it's realistic to see this as unexpected behaviour.

1. And how often do you put a person's email address in the "Event name" (mobile) or "What" (desktop) sections? This "bug" could have been there for years (though more than likely, months), and is only just now being discovered.
2. Normally, if I (and probably several million other people) were to do the procedure as described in the example, I would have just put "email Mr. Joe about so-and-so" because Mr. Joe would more than likely already be in my Contacts with email address.
3. As far as the article describes, this "bug" only affects the Event Name/What sections, not descriptions or "anywhere else".

Well, it happened to me but I did not add the Email, I just added the contact, and it sent a mail to him. It was a date and fortunately he found it "cute" but I can totally see this becoming a super embarrasing moment in another occasion if you don't know what you are doing.

Sent from Android Central App

I can't replicate this behavior, it does pop up asking me to send the invite (so actually confirming it), it doesn't send it automatically, did they already solve it, so fast?