CVE-2026-84920
CVE-2026-84920 · Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.
CVSS 5.3 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
unpublished node permissions
- Versions
- ≥ 0.0.0, < 1.8.0: Affected (semver)
Update to 1.8.0
drupal/unpublished_node_permissions Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 1.8.0
Update to 1.8.0