External attendees cannot reply to invite using the buttons in the mail

Steps to reproduce

1. Create an event and invite an external user with it's email address
2. Login to the external's user email address from a private tab, this issue occurs when no nextcloud account is connected
3. Try to accept or decline the invite
4. You'll be met with an error telling the attendee to contact the organizer because it couldn't update his presence status

Expected behavior

The attendee's presence status should be updated and a confirmation message should be displayed to the attendeee

Actual behavior

Nothing happens regarding the presence status and the attendee gets an error message

Calendar app version

6.0.2

CalDAV-clients used

None in that issue

Browser

Chrome 142

Client operating system

Windows 11

Server operating system

Ubuntu server

Web server

Apache

Database engine version

MariaDB

PHP engine version

PHP 8.3

Nextcloud version

Nextcloud 32.0.1

Updated from an older installed version or fresh install

Updated from an older version

List of activated apps

Enabled:
  - activity: 5.0.0-dev.0
  - admin_audit: 1.22.0
  - announcementcenter: 7.2.2
  - app_api: 32.0.0
  - assistant: 2.9.0
  - bruteforcesettings: 5.0.0-dev.0
  - calendar: 6.0.2
  - circles: 32.0.0
  - cloud_federation_api: 1.16.0
  - collectives: 3.2.4
  - comments: 1.22.0
  - contacts: 8.0.5
  - contactsinteraction: 1.13.1
  - dashboard: 7.12.0
  - dav: 1.34.2
  - deck: 1.16.0
  - drawio: 3.1.2
  - drop_account: 2.7.1
  - end_to_end_encryption: 1.18.0
  - event_update_notification: 2.7.0
  - external: 7.0.0
  - externalpassword: 1.1.2
  - federatedfilesharing: 1.22.0
  - federation: 1.22.0
  - files: 2.4.0
  - files_downloadlimit: 5.0.0-dev.0
  - files_pdfviewer: 5.0.0-dev.0
  - files_reminders: 1.5.0
  - files_sharing: 1.24.0
  - files_trashbin: 1.22.0
  - files_versions: 1.25.0
  - firstrunwizard: 5.0.0-dev.0
  - forms: 5.2.2
  - hidesidebars: 2.2.6
  - impersonate: 3.0.0
  - integration_ews: 1.0.37
  - integration_openai: 3.7.1
  - logreader: 5.0.0-dev.0
  - lookup_server_connector: 1.20.0
  - mail: 5.5.11
  - mailnotifier: 0.0.3
  - music: 2.4.1
  - notes: 4.12.3
  - notifications: 5.0.0-dev.0
  - notify_push: 1.2.0
  - oauth2: 1.20.0
  - onlyoffice: 9.11.0
  - ownershiptransfer: 1.3.0
  - privacy: 4.0.0-dev.0
  - profile: 1.1.0
  - provisioning_api: 1.22.0
  - quota_warning: 1.22.0
  - recommendations: 5.0.0-dev.0
  - related_resources: 3.0.0-dev.0
  - secrets: 2.1.4
  - sendent: 3.1.2
  - serverinfo: 4.0.0-dev.0
  - settings: 1.15.1
  - sharebymail: 1.22.0
  - side_menu: 5.1.3
  - spreed: 22.0.2
  - suspicious_login: 10.0.0-dev.0
  - tables: 1.0.0
  - tasks: 0.17.0
  - terms_of_service: 4.7.0-rc.1
  - text: 6.0.1
  - theming: 2.7.0
  - twofactor_backupcodes: 1.21.0
  - updatenotification: 1.22.0
  - user_oidc: 8.1.0
  - user_retention: 1.15.0
  - user_status: 1.12.0
  - user_usage_report: 3.0.0
  - users_picker: 1.2.1
  - viewer: 5.0.0-dev.0
  - weather_status: 1.12.0
  - welcome: 1.3.0
  - whiteboard: 1.4.0
  - workflowengine: 2.14.0
Disabled:
  - checksum: 1.2.6 (installed 1.2.6)
  - context_chat: 5.0.0 (installed 5.0.0)
  - encryption: 2.20.0 (installed 2.17.0)
  - files_external: 1.24.0 (installed 1.20.0)
  - files_zip: 2.1.0 (installed 2.1.0)
  - groupfolders: 20.1.2 (installed 20.1.2)
  - integration_openproject: 2.10.1 (installed 2.10.1)
  - inventory: 0.1.3 (installed 0.1.3)
  - nextcloud_announcements: 4.0.0-dev.0 (installed 1.17.0)
  - oidc: 1.10.0 (installed 1.10.0)
  - password_policy: 4.0.0-dev.0 (installed 2.0.0)
  - photos: 5.0.0-dev.1 (installed 4.0.0-dev.1)
  - support: 4.0.0-dev.0 (installed 1.8.0)
  - survey_client: 4.0.0-dev.0 (installed 1.16.0)
  - systemtags: 1.22.0 (installed 1.20.0)
  - twofactor_nextcloud_notification: 6.0.0-dev.0 (installed 4.0.0)
  - twofactor_totp: 14.0.0 (installed 12.0.0-dev)
  - user_ldap: 1.23.0
  - webhook_listeners: 1.3.0 (installed 1.2.0)

Nextcloud configuration

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "cloud.company.tld"
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "forwarded_for_headers": [
            "HTTP_X_FORWARDED_FOR"
        ],
        "overwriteprotocol": "https",
        "enabledPreviewProviders": [
            "OC\\Preview\\BMP",
            "OC\\Preview\\GIF",
            "OC\\Preview\\JPEG",
            "OC\\Preview\\MarkDown",
            "OC\\Preview\\MP3",
            "OC\\Preview\\PNG",
            "OC\\Preview\\TXT",
            "OC\\Preview\\XBitmap",
            "OC\\Preview\\OpenDocument",
            "OC\\Preview\\Krita",
            "OC\\Preview\\WebP",
            "OC\\Preview\\Movie"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "32.0.1.2",
        "overwrite.cli.url": "http:\/\/cloud.nekocorp.fr",
        "htaccess.RewriteBase": "\/",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "5060",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "filelocking.enabled": true,
        "memcache.local": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": "6379",
            "password": "***REMOVED SENSITIVE VALUE***"
        },
        "default_phone_region": "FR",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_smtpauthtype": "LOGIN",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "465",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "app_install_overwrite": {
            "0": "officeonline",
            "1": "whiteboard",
            "2": "files_antivirus",
            "3": "googledocsredirect",
            "4": "apporder",
            "5": "integration_moodle",
            "6": "group_default_quota",
            "7": "keeporsweep",
            "8": "files_mindmap",
            "9": "printer",
            "10": "integration_whiteboard",
            "11": "video_converter",
            "12": "carnet",
            "13": "caniupdate",
            "14": "impersonate",
            "15": "ocsms",
            "16": "hancomoffice",
            "17": "wopi",
            "18": "admin_notifications",
            "19": "pdfdraw",
            "21": "shifts",
            "22": "richdocumentscode",
            "24": "camerarawpreviews",
            "25": "hibp",
            "26": "metadata",
            "27": "externalportal",
            "28": "extract",
            "29": "files_downloadlimit",
            "30": "circles",
            "33": "guests",
            "34": "secrets",
            "36": "user_cas",
            "37": "workspace",
            "38": "mailnotifier",
            "40": "htmlviewer",
            "41": "side_menu",
            "42": "deck",
            "43": "drawio",
            "45": "groupfolders",
            "47": "spreed",
            "48": "integration_ews",
            "49": "hidesidebars",
            "50": "externalpassword"
        },
        "theme": "",
        "loglevel": 2,
        "updater.release.channel": "stable",
        "mail_smtpsecure": "ssl",
        "defaultapp": "dashboard,files,spreed",
        "maintenance": false,
        "twofactor_enforced": "false",
        "twofactor_enforced_groups": [
            "everyone"
        ],
        "twofactor_enforced_excluded_groups": [],
        "forbidden_filename_basenames": [
            "con",
            "prn",
            "aux",
            "nul",
            "com0",
            "com1",
            "com2",
            "com3",
            "com4",
            "com5",
            "com6",
            "com7",
            "com8",
            "com9",
            "com\u00b9",
            "com\u00b2",
            "com\u00b3",
            "lpt0",
            "lpt1",
            "lpt2",
            "lpt3",
            "lpt4",
            "lpt5",
            "lpt6",
            "lpt7",
            "lpt8",
            "lpt9",
            "lpt\u00b9",
            "lpt\u00b2",
            "lpt\u00b3"
        ],
        "forbidden_filename_characters": [
            "<",
            ">",
            ":",
            "\"",
            "|",
            "?",
            "*",
            "\\",
            "\/"
        ],
        "forbidden_filename_extensions": [
            " ",
            ".",
            ".filepart",
            ".part"
        ],
        "auth.bruteforce.protection.enabled": true,
        "auth.bruteforce.max-attempts": 10,
        "ratelimit.protection.enabled": true,
        "auth.storeCryptedPassword": true,
        "allow_local_remote_servers": true,
        "maintenance_window_start": 20,
        "activity_expire_days": 365,
        "hide_login_form": true,
        "session_lifetime": 600,
        "remember_login_cookie_lifetime": 0,
        "session_cookie_lifetime": 0,
        "session_keepalive": true,
        "auto_logout": false,
        "files.chunked_upload.max_size": 20971520,
        "auth.webauthn.enabled": false,
        "skeletondirectory": ""
    }
}

Web server error log

1.2.3.4 | - | 30/Oct/2025:10:07:33 +0100 | "cloud.company.tld" | "POST /apps/dav/invitation/moreOptions/<t0k3n> HTTP/1.1" | 200 | 9910 | "-" | "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" "-"

Log file

no log of this error in the nextcloud log (even with debug log level)

Browser log

no error in the console or the network log

Additional info

See the picture of the error

Also, I'm able to get the attendance status of an external attendee updated when loggin into a nextcloud account, using the link they get in the email that gets sent to them. It seems like this issue only manifests itself when no nextcloud account is logged in.

Start by tracing the invitation buttons to the POST /apps/dav/invitation/moreOptions/ entry point, comparing the unauthenticated external-attendee flow with the logged-in flow. Reproduce the accept and decline actions from the issue, then verify that the presence status changes and a confirmation message is shown without a Nextcloud account.