Vulnerability DRUPAL-CONTRIB-2026-244
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
2 hours ago
October 21, 2026 at 06:01 PM UTC
No summary available
<5.2.6
<5.2.6
Details
This module provides a View plugin that integrates a calendar view format powered by FullCalendar JavaScript library.
This module has an access bypass vulnerability which allows to update entity fields without checking field-level access.
The vulnerability is mitigated by the fact that an attacker must have access to update the entity itself.
References
Impacted packages
Timeline
Published
2 hours ago
October 21, 2026 at 06:01 PM UTC
Last Modified
1 hour ago
October 21, 2026 at 06:45 PM UTC