CVE-2026-8495 - Date iCal - Critical - Information disclosure

CRITICAL

Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037

Published May 19, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 0.49%

Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing.

This issue affects Date iCal: from 0.0.0 before 4.0.15.

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Drupal	Date iCal	unaffected	Affected ≥ 0.0.0, < 4.0.15

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30992		Advisory
https://www.drupal.org/sa-contrib-2026-037		Third Party Advisory

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner drupal

Published May 19, 2026

Updated May 20, 2026

Reserved May 13, 2026

CISA Vulnrichment

Updated May 20, 2026

NVD

Status Analyzed

Modified Jul 23, 2026

Red Hat

No data

ENISA EUVD

Assigner drupal

Published May 19, 2026

Updated May 20, 2026

GitHub

No data