SA-CONTRIB-2026-122: Critical severity drupal/calculate_working_days vulnerability
Calculate Working Days allows you to calculate working days between 2 dates. This module doesn't sufficiently restrict access to its settings form.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/calculate_working_daysto a version that resolves this vulnerability.Fixed in 2.0.3
Event History
Frequently Asked Questions
What access would an attacker need to exploit this issue?
The issue involves insufficient access restrictions on the module's settings form. The provided information does not identify the specific permission or user role required to reach that form.
Which deployments are affected by default?
The provided information does not state whether the settings form is exposed under the module's default configuration or only after particular permissions or configuration changes.
What can be done while waiting to patch?
Review and restrict access to the Calculate Working Days settings form so that only trusted administrators can reach it. The advisory data does not provide a specific workaround or required permission to remove.