[IT-SecNots] [Security-news] Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-037

Project: Date iCal [1]
Date: 2026-May-13
Security risk: *Critical* 17 ∕ 25
AC:None/A:None/CI:All/II:None/E:Theoretical/TD:All [2]
Vulnerability: Information disclosure

Affected versions: <4.0.15
CVE IDs: CVE-2026-8495
Description: 
This module enables you to export entity date fields as iCal feeds.

The module doesn't sufficiently check entity or field access or sanitize user
inputs when generating iCal feeds.

This vulnerability is not mitigated by any permission, the routes are
accessible to all anonymous users with no configuration required.

Solution: 
Install the latest version:

 * If you use the Date iCal module for Drupal 10/11, upgrade to Date iCal
   4.0.15 [3]

Reported By: 
 * Drew Webber (mcdruid) [4] of the Drupal Security Team

Fixed By: 
 * Joël Pittet (joelpittet) [5]

Coordinated By: 
 * Greg Knaddison (greggles) [6] of the Drupal Security Team
 * Dave Long (longwave) [7] of the Drupal Security Team
 * Juraj Nemec (poker10) [8] of the Drupal Security Team
 * Drew Webber (mcdruid) [9] of the Drupal Security Team

Security
issue: 
https://git.drupalcode.org/security/38-date_ical-security/-/work_items/1
[10]
------------------------------------------------------------------------------
Contribution record [11]

[1] https://www.drupal.org/project/date_ical
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/date_ical/releases/4.0.15
[4] https://www.drupal.org/u/mcdruid
[5] https://www.drupal.org/u/joelpittet
[6] https://www.drupal.org/u/greggles
[7] https://www.drupal.org/u/longwave
[8] https://www.drupal.org/u/poker10
[9] https://www.drupal.org/u/mcdruid
[10] https://git.drupalcode.org/security/38-date_ical-security/-/work_items/1
[11]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3589652

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at