Project: 
Fullcalendar View
Project machine name: 
fullcalendar_view
Date: 
2026-October-21
Security risk: 
Moderately critical 11 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All
Vulnerability: 
Access bypass
Affected versions: 
<5.2.6
CVE IDs: 
CVE-2026-114545
Description: 

This module provides a View plugin that integrates a calendar view format powered by FullCalendar JavaScript library.

This module has an access bypass vulnerability which allows to update entity fields without checking field-level access.

The vulnerability is mitigated by the fact that an attacker must have access to update the entity itself.

Solution: 

Install the latest version:

Reported By: 
Fixed By: 
Coordinated By: