Incorrect Authorization Issue in Drupal Unpublished Node Permissions
CVE-2026-4933

7.5HIGH

Key Information:

Vendor

Drupal
Status
Unpublished Node Permissions
Vendor
CVE Published:
26 March 2026

What is CVE-2026-4933?

An incorrect authorization vulnerability exists in the Drupal Unpublished Node Permissions module, which can allow unauthorized users to access unpublished content through forceful browsing techniques. This flaw affects versions of the module prior to 1.7.0, potentially exposing sensitive information and compromising site integrity.

Affected Version(s)

Unpublished Node Permissions 0.0.0 < 1.7.0

References

https://www.drupal.org/sa-contrib-2026-029

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andre Groendijk (groendijk)
Fabien Gutknecht (fabsgugu)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
.