Cross-provider calendar modification via missing authorization checks

Broken access control in Easy!Appointments before 1.5.0 allows remote authenticated users to alter other providers' calendar events. Calendar.php performed appointment and unavailability save or delete operations without checking whether the session role was authorized for the selected provider. Provider or secretary access is required, and successful exploitation changes or removes calendar data outside the account's assigned scope.