Live › vulnerability › CVE-2026-114537
The Drupal View Unpublished module has an incorrect authorization flaw that lets someone reach pages by guessing their addresses. An attacker could view content that was never published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running the Drupal View Unpublished module in the affected version range can expose unpublished content to users who guess its address. The sources do not describe the specific configuration needed. Sites without this module can skip it.
No product ranges from the sources yet.
drush pm:list --filter=view_unpublished (unknown if the sources do not say this exact command works)1.5.0 as in the reported range0.0.0 to 1.5.0 are affected; the sources do not name a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-114537")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.