Node View Permissions CVE-2026-8491

The Node View Permissions module must be installed and actively used to restrict access to one or more nodes on the Drupal site. Exploitation requires the attacker to satisfy the high attack complexity condition (AC:H per CVSS vector), meaning a specific exceptional state in the permission check must be triggered - the exact configuration trigger is not detailed in the available advisory text and should be confirmed via the Drupal security advisory at https://www.drupal.org/sa-contrib-2026-034. No authentication is required (PR:N per CVSS vector) and no user interaction is needed (UI:N). Exploitation is limited to reading node content (confidentiality only); attackers cannot modify data or cause service disruption. Sites that do not use the Node View Permissions module are not affected.

The composite risk profile for this vulnerability is low. CVSS 3.7 is corroborated by all available signals: AV:N confirms reachability over the network, but AC:H limits exploitability to scenarios where specific preconditions are met, substantially reducing the attack surface. PR:N means no authentication is required, but the high complexity partially offsets this advantage for an attacker. Impact is limited to confidentiality (C:L) with no integrity or availability consequence (I:N/A:N) and no scope change (S:U). EPSS at 0.01% (3rd percentile) strongly indicates this vulnerability is not being actively targeted or easily reproduced at scale. The absence from CISA KEV and the absence of any identified POC further support treating this as a routine patch-cycle issue rather than an emergency. No conflicting signals were identified between CVSS and the description - the high-complexity network vector is consistent with a conditional forceful browsing flaw.

An attacker identifies a Drupal site with Node View Permissions installed and discovers or enumerates node IDs (e.g., /node/42) for content that should be access-restricted. By crafting a direct HTTP request that triggers an edge-case condition in the module's permission evaluation logic, the attacker receives the restricted node content without authentication. The high attack complexity (AC:H) implies the attacker must identify and satisfy a specific precondition - such as a particular node configuration or request state - before the bypass succeeds. No public POC has been identified at time of analysis.