There are over 8000 publicly accessible Google Calendars, searchable using Google engine itself, that allow anyone to access sensitive details saved to them and add new events with maliciously crafted information or links. Security researcher Avinash Jain, a security researcher from India working in an e-commerce company, Grofers, found vulnerabilities in other platforms like NASA, Google, Jira, and Yahoo. Since Google doesn’t notify the creator of a public Calendar when someone accesses it or adds an event to it, the feature makes it harder for users to know if they are exposing information unintentionally.
Source: https://thehackernews.com/2019/09/google-calendar-search.html