{"id":"CVE-2026-114537","kind":"vulnerability","aliases":["CVE-2026-114537"],"related":[],"title":"Drupal View Unpublished: forceful browsing exposes unpublished content","description":"Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.","summary":"The Drupal View Unpublished module has an incorrect authorization flaw that lets someone reach pages by guessing their addresses. An attacker could view content that was never published.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","drupal","runtime","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check whether the View Unpublished module is installed and at which version, for example with `drush pm:list --filter=view_unpublished` (unknown if the sources do not say this exact command works)\n- Treat any installed version up to `1.5.0` as in the reported range","fix":"- View Unpublished versions from `0.0.0` to `1.5.0` are affected; the sources do not name a fixed version","status":"open","published_at":"2026-10-30T04:18:12+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","triaged_at":"2026-10-30T04:29:57+00:00","updated_at":"2026-10-30T04:29:57+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-30T04:29:57Z","model":"claude-haiku-5-5","output":{"fix":"- View Unpublished versions from `0.0.0` to `1.5.0` are affected; the sources do not name a fixed version","reach":"internet","title":"Drupal View Unpublished: forceful browsing exposes unpublished content","impact":"medium","summary":"The Drupal View Unpublished module has an incorrect authorization flaw that lets someone reach pages by guessing their addresses. An attacker could view content that was never published.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["drupal","self-hosted","cms"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unpublished site content readable by anyone guessing its address","analyst_note":"Check the NVD entry and the Drupal security advisory for the fixed version, the required permissions and whether anonymous users can trigger it.","how_to_check":"- Check whether the View Unpublished module is installed and at which version, for example with `drush pm:list --filter=view_unpublished` (unknown if the sources do not say this exact command works)\n- Treat any installed version up to `1.5.0` as in the reported range","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal View Unpublished module in the affected version range can expose unpublished content to users who guess its address. The sources do not describe the specific configuration needed. Sites without this module can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000677,"input_tokens":4081,"output_tokens":537,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114537':11A,14A '-2026':10A,13A '0.0.0':66C '1.5.0':68C 'address':39B 'affect':61C 'allow':56C 'attack':41B 'author':29B,50C 'brows':5A,58C 'cms':15B 'content':8A,44B 'could':42B 'cve':9A,12A 'drupal':1A,16B,22B,53C 'expos':6A 'flaw':30B 'forc':4A,57C 'guess':37B 'host':20B 'incorrect':28B,49C 'issu':60C 'let':32B 'modul':25B 'never':47B 'page':35B 'publish':48B 'reach':34B 'runtim':17B 'self':19B 'self-host':18B 'someon':33B 'unpublish':3A,7A,24B,55C,63C 'version':64C 'view':2A,23B,43B,54C,62C 'vulner':51C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal View Unpublished module in the affected version range can expose unpublished content to users who guess its address. The sources do not describe the specific configuration needed. Sites without this module can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114537","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114537","severity":null,"published_at":"2026-10-30T04:18:12+00:00","modified_at":"2026-10-30T04:18:12+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","fetched_at":"2026-10-30T04:28:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}