---
id: "CVE-2026-84920"
kind: "vulnerability"
aliases: ["CVE-2026-84920"]
title: "Drupal Unpublished Node Permissions: incorrect authorization lets users browse unpublished content"
severity: "medium"
cvss: 5.3
epss: 0.00228
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "self-hosted"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-22T02:17:02+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:20:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84920", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-84920", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Drupal Unpublished Node Permissions: incorrect authorization lets users browse unpublished content

The Drupal Unpublished Node Permissions module has an incorrect authorization check that allows forceful browsing to unpublished nodes. An attacker can view content that should be restricted to users with the right permissions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the module with `drush pm:list --filter=unpublished_node_permissions` or by reviewing composer.lock for `drupal/unpublished_node_permissions`
- Confirm whether the installed version is 1.8.0 or earlier

## Fix

- Upgrade the Drupal Unpublished Node Permissions module to a version later than `1.8.0`; the fixed version is unknown from the sources

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-84920
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-84920

## From the sources

Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_