CVE-2026-114537
View Unpublished - Moderately critical - Access bypass - SA-CONTRIB-2026-235
Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
View Unpublished - Moderately critical - Access bypass - SA-CONTRIB-2026-235
Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.
- Record
CVE-2026-114537- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-06
EUVDEUVD-2026-113537
Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.
- Record
EUVD-2026-113537- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-84w5-88ph-5gv4
Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This...
Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.
- Record
GHSA-84w5-88ph-5gv4- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-06
NVD
Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.
- Record
CVE-2026-114537- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-06
OSVDRUPAL-CONTRIB-2026-235 No score
This module allows granting access to unpublished nodes per content type.
For nodes with at least one unpublished translation, the module grants every user with the "access content" permission view access to the published translations of that node. This overrides the restrictions of other node access modules, such as Content Access or Domain Access, that might have been in place for these translations.
This vulnerability is mitigated by the fact that the site must be multilingual, a node must have both unpublished and published translations, and another node access module must restrict view access to the published translations.
- Record
DRUPAL-CONTRIB-2026-235- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/view_unpublishedPackagist:https://packages.drupal.org/8 |
before 1.5.0 | 1.5.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| severity | CVE List, EUVD | |
| facts, severity | GitHub Advisories | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-114537 is a medium vulnerability (CVSS 5.3) in Drupal View Unpublished, published October 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. Fixed in drupal/view_unpublished 1.5.0.