Drupal Date iCal CVE-2026-8495

Exploitation requires that the Drupal Date iCal contrib module be installed and enabled at a version below 4.0.15, and that the site expose iCal feed endpoints to the network (the default deployment for a module whose purpose is publishing calendar feeds). Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or non-default configuration is required - an attacker only needs network reachability to the Drupal site's iCal routes and knowledge or enumeration of the target URLs. The principal limiting factor is exposure: sites where Date iCal is not installed, where the affected endpoints sit behind authentication at the reverse-proxy/CDN layer, or where calendar content contains nothing sensitive face materially lower risk.

Signals here conflict sharply. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H rates this as a 9.8 critical, remotely exploitable without authentication or user interaction with full CIA impact - yet the EPSS score of 0.02% (4th percentile) and absence of any KEV listing or public PoC indicate exploitation in the wild is not currently observed. The C:H/I:H/A:H rating in the CVSS appears generous for what is described as forceful-browsing authorization bypass (typically a confidentiality-dominant issue); a real-world impact closer to C:H/I:L/A:L is plausible, and defenders should treat the 9.8 as an upper bound rather than a confirmed worst case. Practical priority is moderate: patch promptly on any internet-exposed Drupal site using Date iCal, especially where calendars contain non-public events, but this is not an immediate-fire-drill given the low EPSS and no observed exploitation.

An unauthenticated attacker enumerates or guesses iCal feed URLs on a Drupal site running Date iCal - for example, requesting node-based or view-based .ics endpoints associated with non-public calendars - and the module returns event data without checking the requester's permissions. The attacker harvests sensitive scheduling information such as internal meetings, executive calendars, or member-only events. No public exploit has been identified at time of analysis, and the attack requires no special tooling beyond a standard HTTP client.