Incorrect Authorization Vulnerability in Drupal Unpublished Node Permissions
CVE-2026-84920

Currently unrated

Key Information:

Vendor

Drupal
Status
Unpublished Node Permissions
Vendor
CVE Published:
22 October 2026

What is CVE-2026-84920?

An authorization flaw in Drupal's Unpublished Node Permissions feature allows users to bypass restrictions, potentially leading to unauthorized access to unpublished content. This vulnerability may enable attackers to gain visibility into sensitive information that was intended to remain private, highlighting the importance of implementing robust access controls. Users are encouraged to update to the latest version to mitigate this risk.

Affected Version(s)

Unpublished Node Permissions 0.0.0 < 1.8.0

References

https://www.drupal.org/sa-contrib-2026-132

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Erwin Eggenberger (eeg)
Jon Jordan (joncjordan)
Fabien Gutknecht (fabsgugu)
Jon Jordan (joncjordan)
Swan Kalata (akalata)
Damien McKenna (damienmckenna)
Neil Drumm (drumm)
Juraj Nemec (poker10)
Pierre Rudloff (prudloff)
.