Missing Authorization vulnerability in Drupal Date iCal

CVE-2026-8495 is a missing-authorization flaw in Drupal's Date iCal module that affects versions < 4.0.15. The module exposes iCal feed routes, and Drupal's advisory says those routes do not sufficiently check entity or field access and also mishandle user input while generating feeds. In plain English: an anonymous requester can hit a public .ics export path and receive calendar-backed content that should have been filtered or denied.

The vendor's CRITICAL 9.8 label overstates what defenders are actually dealing with. The important part is the advisory's own description: this is an information disclosure bug on a contributed module, not a proven RCE or broad platform compromise. Reality pushes severity down because the blast radius depends on who actually deployed Date iCal, whether sensitive content is exposed through those feeds, and whether the site even uses the vulnerable iCal routes externally.

Why this verdict

• Unauthenticated remote path: the attacker position is AV:N/PR:N/UI:N, and Drupal explicitly says the vulnerable routes are accessible to anonymous users with no permission gate.
• Impact is narrower than 9.8 suggests: the vendor advisory calls this Information disclosure; there is no primary-source evidence here of direct pre-auth RCE, admin creation, or whole-site availability loss.
• Population is limited: this is a contributed module with roughly ~569 reporting 4.0.x installs in Drupal usage stats, not a ubiquitous Drupal core issue affecting most internet-facing sites.
• Route exposure is conditional: an attacker still needs the site to actually publish or expose an iCal endpoint containing sensitive content. Many deployments either do not use these feeds or only expose already-public events.
• Modern controls only partially help: EDR does nothing at the web layer, and WAFs are weak here because the request can look like a legitimate ICS download. That keeps the issue above MEDIUM.

Why not higher?

There is no reviewed evidence of KEV listing, active exploitation, or public weaponization. More importantly, the business impact is usually bounded to whatever the feed exposes; this is not the kind of flaw that normally gives an unauthenticated attacker arbitrary code execution across the server.

Why not lower?

You cannot dismiss an anonymous content-bypass on a public web app module as mere backlog hygiene. If a site exposes nonpublic event metadata through ICS, the leak is silent, low-effort, and externally reachable, which is enough to keep this in HIGH for affected internet-facing deployments.

1. Block external access to iCal routes — Put the relevant .ics or module-specific feed paths behind an upstream allowlist, SSO gateway, VPN, or reverse-proxy deny rule if business use permits. This is the fastest risk reduction for exposed sites and should be deployed within 30 days for a HIGH finding, sooner for internet-facing feeds carrying sensitive content.
2. Disable the module where unused — If Date iCal is installed but not operationally required, remove or disable it to eliminate the attack surface entirely. For high-confidence unused deployments, do this within 30 days rather than carrying a niche vulnerable module indefinitely.
3. Restrict sensitive fields from feed outputs — Review Views and feed definitions so titles, descriptions, attendee data, locations, unpublished content, and internal notes are not rendered into public ICS exports. This does not fix the access bug, but it limits blast radius and should be completed within 30 days on exposed sites.
4. Log and alert on anonymous ICS access — Add web-server or reverse-proxy detection for repeated anonymous requests to .ics endpoints, especially high-volume pulls or requests for unusual feed names. This is a containment and hunting measure, not a patch, and should be enabled within 30 days.

Run this on the Drupal application host or on a CI workspace containing the site's codebase, from the project root where composer.lock is present. Invoke it as bash check-date-ical-cve-2026-8495.sh /var/www/drupal and use an account with read access to the code directory; root is not required.

#!/usr/bin/env bash
# check-date-ical-cve-2026-8495.sh
# Detects whether Drupal Date iCal is vulnerable to CVE-2026-8495 based on installed version.
# Usage: bash check-date-ical-cve-2026-8495.sh /path/to/drupal-project
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage error

set -u

TARGET="${1:-}"
if [ -z "$TARGET" ]; then
  echo "UNKNOWN - missing path argument"
  echo "Usage: bash $0 /path/to/drupal-project"
  exit 3
fi

if [ ! -d "$TARGET" ]; then
  echo "UNKNOWN - path does not exist: $TARGET"
  exit 2
fi

LOCKFILE="$TARGET/composer.lock"
INSTALLED_JSON="$TARGET/vendor/composer/installed.json"
PACKAGE="drupal/date_ical"
FIXED="4.0.15"
VERSION=""

# Compare semantic versions using sort -V
ver_lt() {
  [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]
}

extract_from_lock() {
  awk -v pkg="$PACKAGE" '
    BEGIN { RS="\\{"; FS="\n" }
    $0 ~ "\"name\"[[:space:]]*:[[:space:]]*\"" pkg "\"" {
      if (match($0, /"version"[[:space:]]*:[[:space:]]*"([^"]+)"/, m)) {
        print m[1]; exit
      }
    }
  ' "$LOCKFILE" 2>/dev/null
}

extract_from_installed_json() {
  awk -v pkg="$PACKAGE" '
    BEGIN { RS="\\{"; FS="\n" }
    $0 ~ "\"name\"[[:space:]]*:[[:space:]]*\"" pkg "\"" {
      if (match($0, /"version"[[:space:]]*:[[:space:]]*"([^"]+)"/, m)) {
        print m[1]; exit
      }
    }
  ' "$INSTALLED_JSON" 2>/dev/null
}

normalize() {
  echo "$1" | sed -E 's/^v//; s/\.0-patch[0-9]+$//; s/-.*$//'
}

if [ -f "$LOCKFILE" ]; then
  VERSION="$(extract_from_lock)"
fi

if [ -z "$VERSION" ] && [ -f "$INSTALLED_JSON" ]; then
  VERSION="$(extract_from_installed_json)"
fi

if [ -z "$VERSION" ] && command -v composer >/dev/null 2>&1; then
  VERSION="$(cd "$TARGET" 2>/dev/null && composer show drupal/date_ical 2>/dev/null | awk '/^versions/ {print $2; exit}')"
fi

if [ -z "$VERSION" ]; then
  if [ -d "$TARGET/web/modules/contrib/date_ical" ] || [ -d "$TARGET/modules/contrib/date_ical" ]; then
    echo "UNKNOWN - Date iCal module directory exists but installed version could not be determined"
    exit 2
  else
    echo "UNKNOWN - Date iCal does not appear installed from standard paths and no composer metadata found"
    exit 2
  fi
fi

RAW_VERSION="$VERSION"
VERSION="$(normalize "$VERSION")"

if ver_lt "$VERSION" "$FIXED"; then
  echo "VULNERABLE - $PACKAGE version $RAW_VERSION installed; fixed version is $FIXED"
  exit 1
else
  echo "PATCHED - $PACKAGE version $RAW_VERSION installed; not affected by CVE-2026-8495"
  exit 0
fi

Sources

1. Drupal advisory SA-CONTRIB-2026-037
2. Date iCal 4.0.15 release notes
3. Drupal Date iCal usage statistics
4. CIRCL Vulnerability Lookup CVE-2026-8495
5. CISA Known Exploited Vulnerabilities Catalog
6. Vulners aggregation for CVE-2026-8495
7. Drupal security advisories index