CVE-2026-84914: Calculate Working Days Module Access Control Vulnerability
Summary
CVE-2026-84914: Calculate Working Days allows you to calculate working days between 2 dates. This module doesn't sufficiently restrict access to its settings form. Affects drupal/calculate_working_days versions < 2.0.3. Fixed in 2.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Calculate Working Days module for Drupal is designed to facilitate the calculation of working days between two specified dates. This module is widely used in various applications where date calculations are essential for business operations. However, it has been identified that the module does not adequately restrict access to its settings form, potentially exposing sensitive configurations to unauthorized users.
Vulnerability Detail
The vulnerability arises from insufficient access control mechanisms within the Calculate Working Days module. This flaw allows unauthorized users to access and modify the settings form, which could lead to unintended changes in the module's functionality or even compromise the integrity of the application. The lack of proper access restrictions poses a significant risk, especially in environments where sensitive data is handled.
How To Fix
Minimum fixed version
2.0.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the settings form by implementing custom permissions in your Drupal installation. This can be done by modifying the user roles and permissions settings to limit access to only trusted administrators.
Conclusion
The Calculate Working Days module has a critical vulnerability that could allow unauthorized access to its settings. It is crucial for users of this module to update to the latest version to mitigate risks. Implementing temporary workarounds can provide some level of protection until the update is applied.
See every vulnerability recorded for drupal/calculate_working_days →
FAQ
It is a Drupal module that calculates the number of working days between two dates.
It refers to a specific vulnerability in the Calculate Working Days module that allows unauthorized access to its settings.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement custom permissions to restrict access to the settings form as a temporary workaround.
You can reach out to Marcus Johansson, who is credited with identifying this vulnerability, via his Drupal profile.
