Calculate Working Days
Monthly
Missing authorization in the Drupal contributed module Calculate Working Days (versions 0.0.0 through 2.0.3, fixed in 2.0.3) lets unauthenticated remote requests reach routes or pages that should be gated by a permission check, a forceful-browsing style access-control bypass scored CVSS 5.3. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation requires no authentication or user interaction, but the impact is limited to a Low integrity effect with no confidentiality or availability consequences, and only sites that have installed and enabled this specific contributed module in a pre-2.0.3 release are exposed. No public exploit has been identified at time of analysis, there is no CISA KEV listing, EPSS is 0.14% (3rd percentile), and SSVC records exploitation as none with partial technical impact.
Missing authorization in the Drupal contributed module Calculate Working Days (versions 0.0.0 through 2.0.3, fixed in 2.0.3) lets unauthenticated remote requests reach routes or pages that should be gated by a permission check, a forceful-browsing style access-control bypass scored CVSS 5.3. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation requires no authentication or user interaction, but the impact is limited to a Low integrity effect with no confidentiality or availability consequences, and only sites that have installed and enabled this specific contributed module in a pre-2.0.3 release are exposed. No public exploit has been identified at time of analysis, there is no CISA KEV listing, EPSS is 0.14% (3rd percentile), and SSVC records exploitation as none with partial technical impact.