The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Project:
Project machine name:
unpublished_node_permissionsDate:
2026-September-02
Vulnerability:
Access bypass
Affected versions:
<1.8.0
CVE IDs:
CVE-2026-84920
Description:
This module creates permissions per node content type to control access to unpublished content.
The module has allowed view access for published content, overriding other access mechanisms that might have been in place.
Solution:
Install the latest version:
- If you use the Unpublished Node Permissions module, upgrade to Unpublished Node Permissions 8.x-1.8.
Reported By:
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Neil Drumm (drumm) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
