CVE-2026-114537 Drupal CVE debrief

Who should care

Defenders of Drupal sites using the View Unpublished module should assess their exposure and verify the version of the module. This includes reviewing the module's version and determining if the site has multilingual content with unpublished translations. Additionally, defenders should be aware of other node access modules in use and their potential interaction with the View Unpublished module.

Why it matters

The Drupal View Unpublished module vulnerability allows access to unpublished nodes per content type, potentially bypassing other node access modules. Defenders should verify the module version and restrict access to unpublished nodes.

• Defenders need to verify the version of the View Unpublished module to prevent unauthorized access to unpublished nodes.
• Sites with multilingual content and unpublished translations may be affected by this vulnerability.
• Restricting access to unpublished nodes using other node access modules may not be effective due to this vulnerability.

Technical summary

The Drupal View Unpublished module grants access to unpublished nodes per content type. For nodes with at least one unpublished translation, the module grants every user with the 'access content' permission view access to the published translations of that node. This overrides the restrictions of other node access modules, such as Content Access or Domain Access, that might have been in place for these translations. The vulnerability is mitigated by the fact that the site must be multilingual, a node must have both unpublished and published translations, and another node access module must restrict view access to the published translations. Defenders should be aware of the potential impact on their sites,

Defensive priority

Defenders should prioritize verifying the version of the View Unpublished module and restricting access to unpublished nodes.

Recommended defensive actions

• Verify the version of the View Unpublished module and upgrade to 1.5.0 or later
• Restrict access to unpublished nodes using other node access modules
• Monitor for multilingual sites with unpublished translations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The vulnerability is described in the Drupal advisory SA-CONTRIB-2026-235 and the CVE Program record. The affected package is drupal/view_unpublished with version <1.5.0. This information is based on the CVE Program record and the Drupal advisory. Defenders should verify the version of the View Unpublished module and review the official advisory for specific details on affected versions and potential mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.