Incorrect Authorization in Drupal View Unpublished Affects Multiple Versions
CVE-2026-114537

Currently unrated

Key Information:

Vendor

Drupal
Status
View Unpublished
Vendor
CVE Published:
30 October 2026

What is CVE-2026-114537?

The Drupal View Unpublished module has a vulnerability that allows attackers to access unpublished content through forceful browsing techniques. This occurs due to insufficient authorization checks in versions ranging from 0.0.0 to 1.5.0. Administrators should assess their installations immediately to prevent unauthorized access to sensitive information.

Affected Version(s)

View Unpublished 0.0.0 < 1.5.0

References

https://www.drupal.org/sa-contrib-2026-235

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrew L (andrew_l)
Tobias Bähr (tobiasb)
Oleksandr Kuzava (nginex)
Gonçalo Mateus (lolgm)
Tobias Bähr (tobiasb)
Swan Kalata (akalata)
Juraj Nemec (poker10)
.