{"id":"CVE-2026-84920","kind":"vulnerability","aliases":["CVE-2026-84920"],"related":[],"title":"Drupal Unpublished Node Permissions: incorrect authorization lets users browse unpublished content","description":"Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.","summary":"The Drupal Unpublished Node Permissions module has an incorrect authorization check that allows forceful browsing to unpublished nodes. An attacker can view content that should be restricted to users with the right permissions.","severity":"medium","cvss":5.3,"epss":0.00228,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the module with `drush pm:list --filter=unpublished_node_permissions` or by reviewing composer.lock for `drupal/unpublished_node_permissions`\n- Confirm whether the installed version is 1.8.0 or earlier","fix":"- Upgrade the Drupal Unpublished Node Permissions module to a version later than `1.8.0`; the fixed version is unknown from the sources","status":"open","published_at":"2026-10-22T02:17:02+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:20:42+00:00","updated_at":"2026-10-25T04:20:42+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:20:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Drupal Unpublished Node Permissions module to a version later than `1.8.0`; the fixed version is unknown from the sources","reach":"internet","title":"Drupal Unpublished Node Permissions: incorrect authorization lets users browse unpublished content","impact":"medium","summary":"The Drupal Unpublished Node Permissions module has an incorrect authorization check that allows forceful browsing to unpublished nodes. An attacker can view content that should be restricted to users with the right permissions.","category":"package","nicknames":[],"who_cares":["drupal","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"unpublished content readable by users without permission","analyst_note":"Find the fixed version and advisory text at the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-84920) or the Drupal security advisory, then confirm the required permissions.","how_to_check":"- Check the installed version of the module with `drush pm:list --filter=unpublished_node_permissions` or by reviewing composer.lock for `drupal/unpublished_node_permissions`\n- Confirm whether the installed version is 1.8.0 or earlier","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that use the Unpublished Node Permissions module to control access to unpublished content are affected. Sites that do not install this module are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000604,"input_tokens":3336,"output_tokens":541,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-84920':14A,17A '0.0.0':75C '1.8.0':77C 'affect':69C 'allow':35B,64C 'attack':42B 'author':6A,32B,57C 'brows':9A,37B,66C 'check':33B 'content':11A,45B 'cve':12A,15A 'drupal':1A,18B,24B,60C 'forc':36B,65C 'host':22B 'incorrect':5A,31B,56C 'issu':68C 'let':7A 'modul':28B 'node':3A,26B,40B,62C,71C 'packag':19B 'permiss':4A,27B,55B,63C,72C 'restrict':49B 'right':54B 'self':21B 'self-host':20B 'unpublish':2A,10A,25B,39B,61C,70C 'user':8A,51B 'version':73C 'view':44B 'vulner':58C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that use the Unpublished Node Permissions module to control access to unpublished content are affected. Sites that do not install this module are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84920","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84920","severity":null,"published_at":"2026-10-22T02:17:02+00:00","modified_at":"2026-10-22T19:18:02+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-84920","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84920","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}