critical · CVSS v3 9.1

CVE-2026-84920

Drupal Unpublished Node Permissions allows attackers to forcefully browse unpublished content due to incorrect authorization checks. The fla

Overview

Drupal Unpublished Node Permissions allows attackers to forcefully browse unpublished content due to incorrect authorization checks. The flaw exists in versions 0.0.0 through 1.8.0 and can expose sensitive draft pages to unauthenticated users. It is a critical vulnerability with a CVSS score of 9.1.

Description

Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.

Impact

The vulnerability compromises confidentiality by exposing unpublished content to unauthorized users. It can also affect integrity if attackers modify or delete draft content. Website administrators and content creators are directly impacted, as their unpublished data may be leaked or tampered with.

Remediation

Update the Unpublished Node Permissions module to version 1.8.1 or later. If an update is not immediately possible, disable the module or restrict its permissions to trusted roles. Verify that unpublished nodes are not accessible via direct URLs and audit access logs for suspicious activity.

Risk context

The CVSS v3 score of 9.1 classifies this as a critical issue, indicating a high likelihood of exploitation and significant impact. Immediate attention is recommended to prevent potential data leakage.

Affected products

  • Drupal CMS
  • Drupal Unpublished Node Permissions

Scores

Severity
critical
CVSS v2
6.4
CVSS v3
9.1
CVSS v4
—
EPSS
—

Drupal UnpublishedNodePermissions Authorization ForcefulBrowsing Critical AccessControl

← All CVEs

Related CVEs

critical

CVE-2026-87936

The CVE-2026-87936 vulnerability is a critical SQL injection flaw in the amazee.ai Private AI Provider, a Drupal-based service. It allows attackers to inject malicious SQL commands, potentially exposing or corrupting sensitive data. The flaw affects all versions up to 1.4.3.

View analysis

critical

CVE-2026-84921

Drupal Webform Submissions Delete plugin has a missing authorization flaw that lets attackers delete any submission. The vulnerability is present in all releases up to 1.2.0. It can be exploited by unauthenticated users to remove data and potentially disrupt site operations.

View analysis

critical

CVE-2026-84916

Drupal Islandora is vulnerable to missing authorization, enabling forceful browsing of restricted content. Attackers can access sensitive data without authentication. This flaw affects all Islandora releases up to 2.19.0.

View analysis

critical

CVE-2026-84917

Drupal Jsonapi Role Access module has an incorrect authorization flaw that permits forceful browsing of restricted JSON endpoints. Attackers can access sensitive data without proper role checks. The vulnerability affects all versions up to 2.0.2.

View analysis