The Drupal Date iCal module before version 4.0.15 contains a missing authorization vulnerability (CWE-862) that permits forceful browsing attacks. This means that unauthorized users can bypass access controls to view or manipulate calendar data. The vulnerability is remotely exploitable without authentication, with low attack complexity and no user interaction required. The CVSS 3.1 base score is 9.8, reflecting critical impact on confidentiality, integrity, and availability of affected systems.

Successful exploitation can lead to unauthorized disclosure, modification, or deletion of calendar data managed by the Drupal Date iCal module. This compromises the confidentiality, integrity, and availability of the affected system's calendar information. Given the critical CVSS score, the impact is severe for organizations relying on this module.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Drupal Date iCal module and monitor for unusual access patterns. Avoid exposing the vulnerable module to untrusted networks. Follow vendor channels closely for updates on patches or official mitigations.