View online: https://www.drupal.org/sa-contrib-2026-037 Project: Date iCal [1] Date: 2026-May-13 Security risk: *Critical* 17 ∕ 25 AC:None/A:None/CI:All/II:None/E:Theoretical/TD:All [2] Vulnerability: Information disclosure Affected versions: <4.0.15 CVE IDs: CVE-2026-8495 Description: This module enables you to export entity date fields as iCal feeds. The module doesn't sufficiently check entity or field access or sanitize user inputs when generating iCal feeds. This vulnerability is not mitigated by any permission, the routes are accessible to all anonymous users with no configuration required. Solution: Install the latest version: * If you use the Date iCal module for Drupal 10/11, upgrade to Date iCal 4.0.15 [3] Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Joël Pittet (joelpittet) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Dave Long (longwave) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Drew Webber (mcdruid) [9] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/38-date_ical-security/-/work_items/1 [10] ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/date_ical [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/date_ical/releases/4.0.15 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/joelpittet [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/longwave [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/mcdruid [10] https://git.drupalcode.org/security/38-date_ical-security/-/work_items/1 [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....