Unpublished Node Permissions CVE-2026-4933

Drupal with Unpublished Node Permissions module versions 0.0.0 through 1.6.x installed. Remote unauthenticated attacker can directly browse URLs of unpublished nodes. No victim interaction required; default module configuration is vulnerable.

This vulnerability presents moderate to high real-world risk due to its direct impact on content confidentiality. While CVSS and EPSS scores are not provided, the CWE-863 classification (Incorrect Authorization) and the authentication bypass nature of forceful browsing attacks indicate network-accessible exploitation with likely low attack complexity. The vulnerability affects a commonly-used Drupal permission control module, suggesting broad deployment across Drupal sites managing sensitive unpublished content (draft articles, scheduled publications, private documentation). Without explicit CVSS vector data indicating privilege requirements (PR:N/L/H), attack complexity, or user interaction needs, the risk cannot be quantified precisely; however, authorization bypass vulnerabilities typically score 6.5+ and pose material disclosure risk. No KEV status or public exploit code has been identified, suggesting this is not yet actively weaponized, but the straightforward nature of forceful browsing attacks means exploitation is likely automatable and does not require advanced techniques.

An authenticated or unauthenticated remote attacker can enumerate unpublished node URLs (e.g., /node/42) and directly request them in a browser or automated script, bypassing the Unpublished Node Permissions module's role-based access checks. The attacker gains unauthorized read access to sensitive draft content, scheduled announcements, or private documentation that the site administrator intended to restrict. For example, a competitor or malicious user could view draft product announcements scheduled for future publication, or access restricted internal documentation, before the content is intended to be public.