A missing authorization flaw in the Drupal Date iCal module permits forceful browsing, allowing attackers to access calendar data that should be restricted. This vulnerability can lead to unintended exposure of potentially sensitive scheduling information and may compromise user privacy. The weakness is classified as Missing Authorization, indicating that the system does not properly verify that a user is permitted to view the requested resource.

The Drupal Date iCal module, versions starting at 0.0.0 and any release before 4.0.15, is affected. Users running these unpatched releases should assess whether the module is in use and whether calendar data is publicly exposed.

Because the flaw is a straightforward lack of access checks, the likelihood of exploitation is high in environments where the module is deployed and exposed. An attacker would simply request known or guessed iCal URLs without authentication, and if the system does not enforce authorization, sensitive data would be returned. The CVSS score of 9.8 indicates a critical severity, and the EPSS score of < 1% shows that while the overall exploitation probability is low across all systems, the vulnerability remains a high risk in environments where the module is present. The vulnerability is not listed in CISA's KEV catalog. The impact is limited to a confidentiality breach rather than full system compromise.