---
id: "CVE-2026-114537"
kind: "vulnerability"
aliases: ["CVE-2026-114537"]
title: "Drupal View Unpublished: forceful browsing exposes unpublished content"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["cms", "drupal", "runtime", "self-hosted"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-30T04:18:12+00:00"
first_seen_at: "2026-10-30T04:28:37+00:00"
updated_at: "2026-10-30T04:29:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114537", "first_seen_at": "2026-10-30T04:28:37+00:00"}]
---

# Drupal View Unpublished: forceful browsing exposes unpublished content

The Drupal View Unpublished module has an incorrect authorization flaw that lets someone reach pages by guessing their addresses. An attacker could view content that was never published.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the View Unpublished module is installed and at which version, for example with `drush pm:list --filter=view_unpublished` (unknown if the sources do not say this exact command works)
- Treat any installed version up to `1.5.0` as in the reported range

## Fix

- View Unpublished versions from `0.0.0` to `1.5.0` are affected; the sources do not name a fixed version

## Timeline

- 2026-10-30T04:28:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114537

## From the sources

Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_