Unpublished Node Permissions CVE-2026-84920

The target must be a Drupal site running the contributed Unpublished Node Permissions module at a version at or below 1.8.0, and must contain unpublished nodes worth disclosing. The authorization flaw allows directly requesting an unpublished node's URL/ID to bypass the intended access restriction (forceful browsing), so the practical prerequisite is knowing or enumerating the node path. Limiting factors: impact is confined to confidentiality of unpublished content (no modification or denial of service), exposure requires this specific non-core module to be installed and enabled, and the value of the disclosure depends on what unpublished content exists on the site.

This is a moderate-severity information-disclosure issue, not an urgent emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) indicates a network-reachable, low-complexity flaw needing no privileges or user interaction, but with only a Low confidentiality impact and no integrity or availability impact - consistent with CWE-863 Incorrect Authorization enabling forceful browsing to content that should be hidden. Exploitation signals are weak: EPSS is 0.14% (3rd percentile), there is no CISA KEV listing (not confirmed actively exploited), and no public exploit identified at time of analysis - only a vendor security advisory reference. The vuln.today decision label is 'this_month' rather than act_now/emergency, aligning with the low EPSS and absence of active exploitation. The main real-world mitigant is scope: this is a Drupal contributed module, not Drupal core, so exposure is confined to sites that specifically install the Unpublished Node Permissions module. Net: a legitimate but low-priority confidentiality fix to schedule within normal patch cycles, driven by severity rather than by any evidence of exploitation.

An attacker who knows or guesses the URL/node ID of an unpublished Drupal node directly requests it and the Unpublished Node Permissions authorization check fails to block access, disclosing content intended to remain hidden. No authentication, special tooling, or user interaction is required against a site running the vulnerable module. No public exploit code or PoC reference is identified at time of analysis.