CVE-2026-84920: Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132

Q: Which deployments should be treated as affected?

Drupal sites using the Unpublished Node Permissions module in versions 0.0.0 through 1.8.0 should be treated as affected.

Q: What type of unauthorized access does this issue enable?

The vulnerability is an incorrect authorization issue that permits forceful browsing, allowing access controls for unpublished-node content to be bypassed.

Published Oct 22, 2026

Updated

Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.

Affected Software

1 affected component

Drupal Unpublished Node Permissions>=0.0.0<=1.8.0

Event History

Oct 22, 2026

CVE Published

via MITRE·01:22 AM

Data Sourced

via MITRE·01:22 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments should be treated as affected?

Drupal sites using the Unpublished Node Permissions module in versions 0.0.0 through 1.8.0 should be treated as affected.

What type of unauthorized access does this issue enable?

The vulnerability is an incorrect authorization issue that permits forceful browsing, allowing access controls for unpublished-node content to be bypassed.

CVE-2026-84920: Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132

Affected Software

Event History

Frequently Asked Questions

Which deployments should be treated as affected?

What type of unauthorized access does this issue enable?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be treated as affected?

What type of unauthorized access does this issue enable?