CVE-2026-114545 Drupal CVE debrief

Who should care

Drupal users who have installed the FullCalendar View module, particularly those with entity update access, should assess their exposure and prioritize updating the module to version 5.2.6 or later.

Why it matters

The FullCalendar View module for Drupal has an access bypass vulnerability allowing updates to entity fields without field-level access checks. Defenders should prioritize verifying and updating the module, reviewing user access controls, and monitoring entity updates to prevent potential security incidents.

• Defenders must verify and update the FullCalendar View module to prevent potential unauthorized entity field updates.
• Reviewing user access controls for entity updates is crucial to prevent exploitation.
• Monitoring entity updates can help detect potential security incidents.

Technical summary

The FullCalendar View module for Drupal provides a View plugin that integrates a calendar view format powered by FullCalendar JavaScript library. This module has an access bypass vulnerability which allows updates to entity fields without checking field-level access. The vulnerability is mitigated by the fact that an attacker must have access to update the entity itself. Affected versions are < 5.2.6.

Defensive priority

Defenders should prioritize verifying and updating the FullCalendar View module to version 5.2.6 or later, and review user access controls for entity updates.

Recommended defensive actions

• Verify and update the FullCalendar View module to version 5.2.6 or later
• Review user access controls for entity updates
• Monitor entity updates for potential unauthorized changes
• Perform a thorough review of entity update access across the organization
• Implement additional monitoring for entity updates to detect potential security incidents
• Conduct a security audit to identify and address any existing unauthorized entity field updates
• Document and track the verification and update process for the FullCalendar View module

Evidence notes

The vulnerability was reported in the FullCalendar View module for Drupal, which provides a calendar view format powered by FullCalendar JavaScript library. The module has an access bypass vulnerability allowing updates to entity fields without checking field-level access. However, the vulnerability is mitigated by the fact that an attacker must have access to update the entity itself.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.