CVE-2026-84914 in Calculate Working Days Plugin
Summary
by MITRE • 10/22/2026
Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The Calculate Working Days module for the Drupal content management system contains a critical missing authorization flaw that permits forceful browsing, affecting all versions from 0.0.0 through 2.0.3. This vulnerability stems from an insufficient access control mechanism within the module's administrative or user-facing endpoints, where the software fails to verify whether the authenticated user possesses the necessary privileges to execute specific actions or view sensitive data. In a properly secured application, every request that modifies state or exposes private information must be validated against the current session's permissions and role assignments. However, in this instance, the module relies on implicit trust or incomplete checks, allowing any logged-in user, including those with minimal roles such as anonymous users if they can reach the endpoint, to bypass intended restrictions. This type of flaw is classically categorized under CWE-284 Improper Access Control and often maps to MITRE ATT&CK techniques related to Privilege Escalation or Unauthorized Access via Forceful Browsing, where attackers exploit weak boundary enforcement between different user tiers.
The operational impact of this vulnerability is significant because it undermines the integrity and confidentiality of data managed by Drupal sites utilizing this module. Attackers can manipulate URLs or API calls directly to access administrative functions, view restricted configuration settings, or potentially alter calculation parameters that affect business logic dependent on working day calculations. Since Calculate Working Days is often used for scheduling, billing, and project management workflows, unauthorized modification of its core data could lead to incorrect date computations, financial discrepancies, or operational disruptions. Furthermore, if the module exposes internal state or user-specific information without proper checks, it may facilitate further reconnaissance by attackers seeking additional entry points within the Drupal ecosystem. The lack of robust authorization means that even users with low-level access can perform actions reserved for site administrators, effectively elevating their privileges through simple request manipulation rather than exploiting complex code execution flaws.
Mitigation strategies must focus on immediate patching and enhanced security configurations to address this deficiency. Site administrators should upgrade the Calculate Working Days module to version 2.0.4 or later, where the developers have presumably implemented stricter access control checks aligned with Drupal's core permission system. Until an update is applied, temporary mitigations include restricting direct URL access through web server configuration rules if possible, although this is less effective than fixing the code-level issue. It is also advisable to audit user roles and permissions within the Drupal administration interface to ensure that no unnecessary privileges are granted to low-trust accounts. Regular security audits and penetration testing should be conducted to identify similar authorization gaps in other modules, as missing access controls remain one of the most prevalent vulnerabilities in web applications. Adhering to secure coding standards such as OWASP Top 10 guidelines for broken access control is essential to prevent recurrence and maintain a robust defense posture against unauthorized access attempts.