Project Ricochet's top notch developers, designers and PM’s allowed us to bring our vision of an e-commerce style class search to life. We had a tight budget and a lot of unexpected problems on the Berkeley side. Utilizing Ricochet's state of the art tracking tools and disciplined scrum approach allowed us to surmount every challenge and end up with a fantastic application. We loved the creative collaboration that allowed us to remake a boring campus class schedule into a high-octane search tool that our students and faculty love! Thank you Casey and the whole PR team!
—Johanna Metzgar

Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037

Wed, 2026-05-13 10:19 — Anonymous (not verified)

Project: Date iCalDate: 2026-May-13Security risk: Critical 17 ∕ 25 AC:None/A:None/CI:All/II:None/E:Theoretical/TD:AllVulnerability: Information disclosureAffected versions: <4.0.15CVE IDs: CVE-2026-8495Description: This module enables you to export entity date fields as iCal feeds.
The module doesn't sufficiently check entity or field access or sanitize user inputs when generating iCal feeds.
This vulnerability is not mitigated by any permission, the routes are accessible to all anonymous users with no configuration required.Solution: Install the latest version:

If you use the Date iCal module for Drupal 10/11, upgrade to Date iCal 4.0.15

Reported By:

Drew Webber (mcdruid) of the Drupal Security Team

Fixed By:

Joël Pittet (joelpittet)

Coordinated By:

Greg Knaddison (greggles) of the Drupal Security Team
Dave Long (longwave) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team
Drew Webber (mcdruid) of the Drupal Security Team

Path to article https://www.drupal.org/sa-contrib-2026-037

Search form

Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037