Unpublished Node Permissions
Monthly
Unpublished Node Permissions module for Drupal versions prior to 1.7.0 contains an incorrect authorization vulnerability (CWE-863) that permits forceful browsing of unpublished nodes by bypassing access controls. Attackers can view content that should be restricted to specific user roles by directly accessing node URLs, circumventing the module's permission enforcement logic. No public exploit code or active exploitation has been identified at the time of analysis.
Forceful browsing in the Drupal contributed module Unpublished Node Permissions (versions 0.0.0 through 1.8.0) lets unauthenticated remote visitors retrieve unpublished node content by requesting a node's URL or ID directly, bypassing the access restriction the module is meant to enforce. Only Drupal sites that have installed and enabled this non-core module are exposed, and the impact is confined to confidentiality of unpublished content, with no modification or denial of service. No public exploit identified at time of analysis; EPSS is 0.14% (3rd percentile) and a vendor patch is available per the Drupal security advisory, so this is a moderate-severity information-disclosure issue to be scheduled for patching this month rather than an emergency.
Unpublished Node Permissions module for Drupal versions prior to 1.7.0 contains an incorrect authorization vulnerability (CWE-863) that permits forceful browsing of unpublished nodes by bypassing access controls. Attackers can view content that should be restricted to specific user roles by directly accessing node URLs, circumventing the module's permission enforcement logic. No public exploit code or active exploitation has been identified at the time of analysis.
Forceful browsing in the Drupal contributed module Unpublished Node Permissions (versions 0.0.0 through 1.8.0) lets unauthenticated remote visitors retrieve unpublished node content by requesting a node's URL or ID directly, bypassing the access restriction the module is meant to enforce. Only Drupal sites that have installed and enabled this non-core module are exposed, and the impact is confined to confidentiality of unpublished content, with no modification or denial of service. No public exploit identified at time of analysis; EPSS is 0.14% (3rd percentile) and a vendor patch is available per the Drupal security advisory, so this is a moderate-severity information-disclosure issue to be scheduled for patching this month rather than an emergency.