CVE-2026-4933

CVE-2026-4933: Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-029

Vendor Drupal
Product Unpublished Node Permissions
Weakness CWE-863 · Incorrect authorization
Published March 26, 2026
Last update March 30, 2026
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing.This issue affects Unpublished Node Permissions: from 0.0.0 before 1.7.0.

Explanation of Vulnerability in Simple Terms

02Summary

The Unpublished Node Permissions module for Drupal contains an authorization flaw that allows users to access or modify unpublished nodes beyond their intended permissions. The vulnerability stems from incorrect permission checks when handling unpublished content. Administrators should update to version 1.7.0 or later to resolve this issue.

What an attacker can do

03Attacker Capabilities

Access or modify unpublished nodes that should be restricted to specific users.

Potential impact on your site

04Site Impact

Unpublished content may be exposed to unauthorized users, risking data leakage or unintended modifications.

Conditions required to exploit

05Prerequisites

User must have some level of access to the Drupal site; specific privilege requirements unknown.

Key dates

06Disclosure timeline

March 26, 2026 CVE published
March 30, 2026 Record updated