CVE-2026-114545 in Fullcalendar View
Summary
by MITRE • 10/30/2026
Incorrect Authorization vulnerability in Drupal Fullcalendar View allows Forceful Browsing. This issue affects Fullcalendar View versions: from 0.0.0 to 5.2.6.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The identified security flaw resides within the Drupal module known as Fullcalendar View, specifically affecting version ranges from initial releases up through version 5.2.6. This vulnerability is classified under the category of Incorrect Authorization, which fundamentally represents a failure in the application to properly enforce access controls on specific resources or functions. In this context, the issue manifests as Forceful Browsing, also commonly referred to as insecure direct object reference manipulation when applied to web applications. The core technical deficiency lies in the module's handling of HTTP requests directed at calendar-related endpoints and data structures without adequate verification of the requesting user's permissions relative to the specific resource being accessed.
From a technical perspective, the vulnerability allows an authenticated attacker who possesses valid credentials for any Drupal account to bypass intended restrictions on viewing or manipulating fullcalendar view configurations and associated event data. The application fails to validate whether the current session has explicit authorization to interact with the targeted calendar views. This oversight enables the attacker to construct malicious URLs that directly reference internal identifiers, such as node IDs or view arguments, thereby accessing sensitive information or triggering actions intended only for administrators or users with specific roles. The lack of server-side validation means that client-side security measures are insufficient and easily circumvented by simply altering request parameters in a web browser or using automated scripting tools to iterate through potential resource identifiers.
The operational impact of this vulnerability is significant, particularly in environments where Fullcalendar View is used for managing sensitive schedules, internal corporate events, or confidential project timelines. An attacker can exploit this flaw to enumerate existing calendar views and extract detailed information about scheduled activities that were not intended for public disclosure. This exposure facilitates further reconnaissance efforts, allowing the adversary to map out organizational structures based on event participants, locations, and timing. Furthermore, depending on the specific configuration of the Drupal site, there may be a risk of unauthorized modification or deletion of calendar entries if additional write permissions are loosely coupled with these read-access flaws. The ability to force browse into restricted areas undermines the principle of least privilege and compromises the integrity and confidentiality of the data managed by the module.
This vulnerability aligns closely with CWE-284, which describes Improper Access Control, specifically highlighting failures in authorization checks that allow users to access resources they should not be permitted to view or modify. It also maps directly to MITRE ATT&CK technique T1078, Valid Accounts, as the exploitation relies on using legitimate credentials to gain unauthorized access to specific application functions rather than breaking into an account through credential theft. Additionally, it relates to CWE-639, Authorization Bypass Through Forceful Browsing, which explicitly covers scenarios where attackers manipulate URLs or parameters to bypass security checks by directly accessing internal objects.
To mitigate this risk, organizations running affected versions of the Fullcalendar View module must immediately upgrade to a patched version that addresses these authorization gaps. The Drupal community typically releases updates that enforce strict permission checks on all view-related endpoints, ensuring that only users with appropriate roles can access or modify calendar data. In addition to updating software, administrators should implement robust web application firewall rules that detect and block patterns associated with forceful browsing attempts, such as unusual sequences of parameter manipulation in URLs related to fullcalendar views. Regular security audits and penetration testing focused on authorization logic are also recommended to identify similar flaws across the broader Drupal ecosystem before they can be exploited by malicious actors.