If an attacker is able to create an account with a username like "user/calendar.ics", he can access collections of other users.
If an attacker is able to create an account with a username like "user/calendar.ics", he can access collections of other users.