PT-2026-120918

CVE-2026-114545

Published

2026-10-21

Updated

2026-10-30

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Drupal Fullcalendar View versions 0.0.0 through 5.2.6

Description An incorrect authorization issue allows forceful browsing and an access bypass. This allows an attacker to update entity fields without the system verifying field-level access. This action requires the attacker to already possess permissions to update the entity itself.

Recommendations Update Drupal Fullcalendar View to a version later than 5.2.6.

Exploitability

Exploit

Fix

Impacts

Researchers

Juraj Nemec

Maksim Hayder

Mingsong

Vendors

Affected products

Weakness enumeration