Live › vulnerability › CVE-2026-84920
Go to dashboardThe Drupal Unpublished Node Permissions module has an incorrect authorization check that allows forceful browsing to unpublished nodes. An attacker can view content that should be restricted to users with the right permissions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Drupal sites that use the Unpublished Node Permissions module to control access to unpublished content are affected. Sites that do not install this module are not affected.
No product ranges from the sources yet.
drush pm:list --filter=unpublished_node_permissions or by reviewing composer.lock for drupal/unpublished_node_permissions1.8.0; the fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-84920")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.