SA-CONTRIB-2026-244: Critical severity drupal/fullcalendar_view vulnerability

Q: Who can exploit this issue?

An attacker must already have permission to update the affected entity. The issue does not remove the requirement for entity update access.

Q: What access control is bypassed?

The vulnerability allows updating entity fields without enforcing field-level access checks. This can expose fields that the user should not be permitted to modify despite being allowed to update the entity.

Published Oct 21, 2026

Updated

This module provides a View plugin that integrates a calendar view format powered by FullCalendar JavaScript library. This module has an access bypass vulnerability which allows to update entity fields without checking field-level access. The vulnerability is mitigated by the fact that an attacker must have access to update the entity itself.

Credit

Maksim Hayder (tr_jan)

Affected Software

1 affected componentFixes available

drupal/fullcalendar_view<5.2.6

5.2.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/fullcalendar_view to a version that resolves this vulnerability.
Fixed in 5.2.6

Event History

Oct 21, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-114545

Frequently Asked Questions

Who can exploit this issue?

An attacker must already have permission to update the affected entity. The issue does not remove the requirement for entity update access.

What access control is bypassed?

The vulnerability allows updating entity fields without enforcing field-level access checks. This can expose fields that the user should not be permitted to modify despite being allowed to update the entity.

SA-CONTRIB-2026-244: Critical severity drupal/fullcalendar_view vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

What access control is bypassed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access control is bypassed?