CVE-2025-48916
📋 TL;DR
This CVE describes a Missing Authorization vulnerability in Drupal's Bookable Calendar module that allows attackers to access restricted functionality through forceful browsing. Attackers can bypass intended access controls to perform unauthorized actions. All Drupal sites using vulnerable versions of the Bookable Calendar module are affected.
💻 Affected Systems
- Drupal Bookable Calendar module
📦 What is this software?
Bookable Calendar by Joshfabean
⚠️ Risk & Real-World Impact
Worst Case
Attackers could manipulate booking data, view sensitive calendar information, modify reservations, or potentially escalate privileges within the booking system.
Likely Case
Unauthorized users accessing booking management functions, viewing private calendar data, or making unauthorized modifications to existing bookings.
If Mitigated
Limited impact with proper network segmentation and additional authorization layers, though the core vulnerability remains.
🎯 Exploit Status
Exploitation requires knowledge of the module's URL structure but no special tools or advanced skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.13
Vendor Advisory: https://www.drupal.org/sa-contrib-2025-070
Restart Required: No
Instructions:
1. Update the Bookable Calendar module to version 2.2.13 or later via Drupal's update manager. 2. Clear Drupal caches. 3. Verify the update was successful.
🔧 Temporary Workarounds
Temporary Access Restriction
allImplement additional access controls at the web server level to restrict access to Bookable Calendar paths
🧯 If You Can't Patch
- Implement strict access controls and authentication checks for all Bookable Calendar endpoints
- Disable or remove the Bookable Calendar module if not essential
🔍 How to Verify
Check if Vulnerable:
Check the Bookable Calendar module version in Drupal's Extend page or via drush: drush pm-list | grep bookable_calendarCheck Version:
drush pm-list --fields=name,version | grep bookable_calendarVerify Fix Applied:
Confirm module version is 2.2.13 or higher and test that unauthorized users cannot access booking management functions📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /bookable-calendar/* paths in web server logs
- Failed authorization checks in Drupal logs
Network Indicators:
- Unusual patterns of requests to booking endpoints from unauthorized users
SIEM Query:
source="web_server_logs" AND (uri_path="/bookable-calendar/*" OR uri_path="/admin/config/services/bookable-calendar/*") AND response_code=200 AND user_agent NOT IN ("authorized_user_agents")