Calculate Working Days EUVD-2026-107877

The affected component is the Drupal contributed module 'Calculate Working Days' at any version from 0.0.0 up to (but not including) 2.0.3; a site must have this specific module installed and enabled. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are stated as required - exploitation is network-reachable and low-complexity against affected installations. The exact endpoint/feature lacking the authorization check and any routing prerequisites are not described in the available sources. The principal limiting factor is footprint: only Drupal sites running this particular contributed module in a pre-2.0.3 version are exposed, and the impact is confined to a Low integrity effect with no confidentiality or availability consequences.

This is a genuine-but-low-priority access-control weakness, not a high-severity emergency. The CVSS 3.1 base score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, meaning network-reachable, low-complexity, unauthenticated exploitation with only a Low integrity impact and no confidentiality or availability impact. That modest impact is consistent with a Missing Authorization / forceful-browsing flaw (CWE-862). The exploitation signals reinforce low urgency: EPSS is 0.14% (3rd percentile), the vulnerability is NOT in CISA KEV, and no public exploit or PoC is referenced - only vendor/NVD advisories. SSVC gives Exploitation=none, Automatable=yes, Technical Impact=partial; the 'Automatable=yes' is the only elevating factor, indicating that IF an exploit emerged it could be scripted at scale, but current real-world exploitation evidence is absent. The vuln.today decision label is 'this_month', which is a routine-patch cadence rather than act_now/emergency, and it aligns with the low EPSS and no-KEV status. There are no strongly conflicting signals here: every source points to a legitimate medium-severity issue affecting a niche Drupal contributed module, worth patching on a normal monthly cycle rather than treating as a priority incident.

A remote, unauthenticated attacker directly requests a URL or route exposed by the Calculate Working Days module that lacks a proper authorization check, performing forceful browsing to reach functionality or modify data they should not be able to (Low integrity impact, no data disclosure or outage). The CVSS vector (AV:N/AC:L/PR:N/UI:N) makes this trivial to attempt with a crafted HTTP request and no user interaction, but no public exploit code or PoC is identified at time of analysis.