CVE-2026-114545

CVE-2026-114545 · DRUPAL-CONTRIB-2026-244

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This module provides a View plugin that integrates a calendar view format powered by FullCalendar JavaScript library. This module has an access bypass vulnerability which allows to update entity fields without checking field-level access. The vulnerability is mitigated by the fact that an attacker must have access to update the entity itself.

Fix available

Published

2026-10-21T18:01:26Z

Updated

2026-10-21T18:45:02.707999254Z

Stack: php

Check your server →