CVE-2025-48916 Bookable Calendar - Less critical - Access bypass - SA-CONTRIB-2025-070
Attackers can bypass authorization checks to access restricted calendar data via forceful browsing in the Drupal Bookable Calendar module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-48916?
CVE-2025-48916 is a medium-severity missing authorization vulnerability in Drupal Bookable Calendar, published on 13 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing Authorization vulnerability in Drupal Bookable Calendar allows Forceful Browsing.This issue affects Bookable Calendar: from 0.0.0 before 2.2.13.
Weakness: CWE-862
Which versions are affected by CVE-2025-48916?
It affects 1 product.
Linux distribution packages (1)
drupal/bookable_calendar Packagist:https://packages.drupal.org/8 | All versions | 2.2.13 |
Products include Joshfabean Bookable Calendar.
How do I fix CVE-2025-48916?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-48916 being exploited?
There is no known exploitation of CVE-2025-48916 in the wild and no public exploit code.
Sources
Also known as DRUPAL-CONTRIB-2025-070, GHSA-p996-488q-cfm2.