Drupal Date iCal Missing Authorization Vulnerability Allowing Forceful Browsing

A missing authorization vulnerability has been identified in the Drupal Date iCal module, versions prior to 4.0.15. This vulnerability allows forceful browsing by not adequately checking access permissions for entities or fields when generating iCal feeds. As a result, all anonymous users can access these routes without any configuration required, leading to potential information disclosure.

Impact

Exploitation of this vulnerability could result in unauthorized access to entity date fields, allowing sensitive information to be exposed through iCal feeds.

Remediation

Users of the Date iCal module for Drupal 10/11 should upgrade to Date iCal version 4.0.15.