PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-84914 Drupal CVE debrief

The Calculate Working Days module for Drupal has a Missing Authorization vulnerability allowing Forceful Browsing. This issue affects versions from 0.0.0 to 2.0.3. The vulnerability could allow attackers to bypass authorization and access sensitive information or functionality. Drupal site administrators and security teams should assess exposure and apply patches or updates to prevent potential unauthorized access. The CVE record and source item provide details on the vulnerability, but additional information from the vendor and other sources may be necessary for comprehensive risk assessment.

Vendor
Drupal
Product
Calculate Working Days
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-22
Advisory published
2026-10-22
Advisory updated
2026-10-22

Who should care

Drupal site administrators and security teams should assess exposure and apply patches or updates to the Calculate Working Days module to prevent potential unauthorized access.

Why it matters

The Calculate Working Days module for Drupal has a Missing Authorization vulnerability, which could allow for Forceful Browsing and potential unauthorized access. Defenders should prioritize verifying exposure, applying patches, and updating access controls to prevent potential security incidents.

  • Potential unauthorized access to sensitive information or functionality
  • Possible disruption of critical business operations or services
  • Need for verification of module version and patch application
  • Potential for increased monitoring and incident response activities

Technical summary

The Calculate Working Days module for Drupal is vulnerable to a Missing Authorization issue, which could allow for Forceful Browsing. This affects versions from 0.0.0 to 2.0.3 of the module. The vulnerability arises from inadequate authorization checks, potentially allowing unauthorized access to sensitive information or functionality. Defenders should prioritize verifying exposure and applying patches for the Calculate Working Days module, particularly for versions prior to 2.0.3.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for the Calculate Working Days module, particularly for versions prior to 2.0.3.

Recommended defensive actions

  • Verify the version of the Calculate Working Days module in use and compare it to the affected versions.
  • Apply patches or updates to the Calculate Working Days module to address the vulnerability.
  • Review and update access controls and authorization mechanisms for the Drupal installation.

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information from the vendor and other sources may be necessary for comprehensive risk assessment.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-84914 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-84914

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-84914 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-84914

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.