View online: https://www.drupal.org/sa-contrib-2026-244 Project: Fullcalendar View [1] Project machine name: fullcalendar_view Date: 2026-October-21 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <5.2.6 CVE IDs: CVE-2026-114545 Description: This module provides a View plugin that integrates a calendar view format powered by FullCalendar JavaScript library. This module has an access bypass vulnerability which allows to update entity fields without checking field-level access. The vulnerability is mitigated by the fact that an attacker must have access to update the entity itself. Solution: Install the latest version: * If you use the Fullcalendar View module, upgrade to Fullcalendar View 5.2.6 [3] Reported By: * Maksim Hayder (tr_jan) [4] Fixed By: * Mingsong (mingsong) [5], provisional member of the Drupal Security Team Coordinated By: * Juraj Nemec (poker10) [6] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [7] [1] https://www.drupal.org/project/fullcalendar_view [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/fullcalendar_view/releases/5.2.6 [4] https://www.drupal.org/u/tr_jan [5] https://www.drupal.org/u/mingsong [6] https://www.drupal.org/u/poker10 [7] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....