CVE-2026-8495

CriticalCVSS 9.8

Published: 19/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

29th percentile - higher than 29% of all known CVEs

Summary

Missing authorization in the Date iCal module for Drupal allows forceful browsing, enabling unauthorized access to resources. Affects versions before 4.0.15.

Risk Assessment

An attacker can access sensitive calendar and event data without proper permissions, compromising information confidentiality.

Recommendation

Immediately update the Date iCal module to version 4.0.15 or later.

Original NVD description (English source)

Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing. This issue affects Date iCal: from 0.0.0 before 4.0.15.