- Package
- drupal/fullcalendar_view
- Fixed in
- 5.2.6
- Published
- Wed 21 Oct 2026, 19:01 Lisbon
In plain words
The Fullcalendar View module can allow an attacker to update entity fields without checking field-level access. The attacker must already have permission to update the entity itself.
Am I affected?
Look for drupal/fullcalendar_view and its installed version in composer.lock. The advisory lists 5.2.6 as fixed but gives no affected version range. Check whether users can update entities whose individual fields they should not be allowed to change.
What to do
Check which version you have, then update to a fixed release for your branch (5.2.6):
composer show drupal/fullcalendar_view | grep versions
composer update drupal/fullcalendar_viewIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
If you cannot update yet
The vulnerability is mitigated by the requirement that an attacker must have access to update the entity itself.
The advisory's description
This module provides a View plugin that integrates a calendar view format powered by FullCalendar JavaScript library.
This module has an access bypass vulnerability which allows to update entity fields without checking field-level access.
The vulnerability is mitigated by the fact that an attacker must have access to update the entity itself.
The advisory
- OSV.dev: DRUPAL-CONTRIB-2026-244
- The week's digest, with the other advisories from 19 Oct 2026
- All advisories for drupal/fullcalendar_view