{"id":"CVE-2026-84920","aliases":["DRUPAL-CONTRIB-2026-132","EUVD-2026-107867","GHSA-gccc-p56f-qc53"],"status":"published","title":"Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132","description":"Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00289,"percentile":0.21704,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-09-02T16:38:32Z","modified":"2026-10-22T21:33:40Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/unpublished_node_permissions","fixed_in":["1.8.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/unpublished_node_permissions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0"}]}]}],"products":[{"vendor":"drupal","product":"unpublished node permissions"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-132","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84920"},{"url":"https://github.com/advisories/GHSA-gccc-p56f-qc53"}],"sources":{"cve":[{"id":"CVE-2026-84920","title":"Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132","description":"Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.","status":"published","published":"2026-10-22T01:22:06.941Z","modified":"2026-10-22T18:28:33.244Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:20:08.734143Z"}],"euvd":[{"id":"EUVD-2026-107867","description":"Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.","status":"published","published":"2026-10-22T01:22:06Z","modified":"2026-10-22T18:28:33Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:34.378575Z"}],"ghsa":[{"id":"GHSA-gccc-p56f-qc53","title":"Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful...","description":"Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.","status":"published","published":"2026-10-22T03:33:39Z","modified":"2026-10-22T21:33:40Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:14:18.215402Z"}],"nvd":[{"id":"CVE-2026-84920","description":"Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.","status":"published","published":"2026-10-22T02:17:02.547Z","modified":"2026-10-22T19:18:02.777Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:13:02.371082Z"}],"osv":[{"id":"DRUPAL-CONTRIB-2026-132","description":"This module creates permissions per node content type to control access to unpublished content.\n\nThe module has allowed view access for published content, overriding other access mechanisms that might have been in place.","status":"published","published":"2026-09-02T16:38:32Z","modified":"2026-09-02T19:55:49.823522Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}