Executive brief
The Date iCal module for Drupal, which allows websites to export calendar data, contains a security flaw that fails to check user permissions. This allows unauthorized individuals to access and download sensitive calendar information or private event details that should be restricted. An attacker can exploit this simply by visiting specific web addresses on the site without needing an account.
Technical details
The Date iCal module fails to perform sufficient entity or field-level access control checks when generating iCal feeds. This missing authorization (CWE-862) allows unauthenticated attackers to perform 'forceful browsing' to access restricted data via the module's routes. The vulnerability is not mitigated by any specific permissions and is accessible to anonymous users by default. Attackers can exploit this to disclose information from entity date fields that should otherwise be private. The issue is resolved in version 4.0.15.
Affected products
- Drupal Date iCal 0.0.0 to 4.0.14
Timeline
- 2026-05-13: advisory: Drupal security advisory SA-CONTRIB-2026-037 published
- 2026-05-19: disclosed: CVE-2026-8495 published to NVD