A significant security flaw has been identified in the Drupal Date iCal module, posing a critical risk to websites using it. This vulnerability, tracked as CVE-2026-8495, is a missing authorization issue that could allow attackers to bypass security checks and access unauthorized content or functionalities, a technique often referred to as “forceful browsing.” This means an attacker might be able to view or manipulate data they shouldn’t have access to simply by guessing or directly navigating to specific URLs.
CVE Details
This critical vulnerability impacts the Drupal Date iCal module, which is used to integrate iCalendar features into Drupal websites. The issue stems from insufficient authorization checks, allowing unprivileged users or attackers to perform actions or access resources that should be restricted. It was first published on May 19, 2026, and its status is currently “Analyzed.”
- Product: Drupal Date iCal module
- Published Date: May 19, 2026
- Severity: Critical (CVSS Score: 9.8)
- Status: Analyzed
Affected Products
The “Missing Authorization” vulnerability affects all versions of the Date iCal module for Drupal starting from version 0.0.0 up to, but not including, version 4.0.15. If your Drupal site uses the Date iCal module within this version range, it is vulnerable to this critical flaw.
Current Status
As of May 27, 2026, this vulnerability has been analyzed and publicly disclosed. Users of the affected module are strongly advised to take immediate action to secure their installations.
Severity Level
With a CVSS score of 9.8, this vulnerability is rated as Critical. A critical severity indicates that the flaw is easy to exploit and can lead to severe consequences, including unauthorized data access, modification, or even control over parts of the affected system, without requiring complex attack methods or user interaction.
Possible Solutions
The primary solution for this critical vulnerability is to update your Date iCal module to a patched version. Specifically, users should update their Date iCal module to version 4.0.15 or later. Updating to the latest secure version ensures that the missing authorization checks are properly implemented, preventing forceful browsing attacks.
Always ensure you back up your website before performing any updates, especially for critical security patches. After updating, clear your Drupal caches to ensure the new code is fully active.
References
https://www.drupal.org/sa-contrib-2026-037
