Live › vulnerability › CVE-2026-84914
Go to dashboardThe Drupal Calculate Working Days module is missing an authorization check, so a visitor can reach pages or routes they should not see by requesting the URL directly. The sources do not say what data or actions those routes expose.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Calculate Working Days at version or earlier. The sources do not say which routes are exposed or whether anonymous users can reach them. Sites that do not have the module installed can skip this.
2.0.3No product ranges from the sources yet.
drush pm:list --filter=calculate_working_days or the Extend page in the Drupal admindrupal/calculate_working_days and note the version2.0.3, per the Drupal.org project page (the sources do not name the fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-84914")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.