CVE-2026-84920: Unpublished Node Permissions Module Allows Unauthorized Access to Published Content
Summary
CVE-2026-84920: This module creates permissions per node content type to control access to unpublished content. Affects drupal/unpublished_node_permissions versions < 1.8.0. Fixed in 1.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'unpublished_node_permissions' module for Drupal is designed to manage permissions for viewing unpublished content based on node content types. It provides a mechanism to control access to unpublished content, ensuring that only authorized users can view it. However, a flaw in this module has been identified, where it inadvertently allows view access to published content, potentially overriding other access controls that may be in place.
Vulnerability Detail
The vulnerability arises from the module's handling of permissions, which permits view access to published content without proper checks. This oversight can lead to unauthorized users gaining access to content that should be restricted, thereby compromising the integrity of the access control mechanisms in place. The issue is particularly concerning for sites that rely on strict content visibility rules, as it undermines the intended privacy and security of unpublished content.
How To Fix
Minimum fixed version
1.8.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually review and adjust the permissions for published content within your Drupal site to ensure that unauthorized users do not have access. However, this is not a permanent solution and updating the module is strongly advised.
Conclusion
In summary, the 'unpublished_node_permissions' module has a critical vulnerability that allows unauthorized access to published content. It is essential to update the module to version 1.8.0 or later to mitigate this risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for drupal/unpublished_node_permissions →
FAQ
The vulnerability allows unauthorized users to view published content that should be restricted, potentially exposing sensitive information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, the vulnerability has been patched in version 1.8.0 of the 'unpublished_node_permissions' module.
If you cannot update the module right away, review and adjust your permissions for published content as a temporary measure.
You can reach out to the Drupal security team or the module maintainers for more information and assistance.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/unpublished_node_permissions.
