PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-84920 Drupal CVE debrief

An Incorrect Authorization vulnerability exists in Unpublished Node Permissions for Drupal, allowing for Forceful Browsing. This issue affects versions from 0.0.0 to 1.8.0. The vulnerability could lead to potential access bypass, allowing unauthorized users to view unpublished content. Site administrators and security teams should verify exposure and apply patches to mitigate potential risks. The impact of this vulnerability requires verification from official sources, and affected versions need to be confirmed. Drupal site administrators should prioritize verifying exposure and applying patches due to potential access bypass risks. Additional verification is needed to confirm the

Vendor
Drupal
Product
Unpublished Node Permissions
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-22
Advisory published
2026-10-22
Advisory updated
2026-10-22

Who should care

Drupal site administrators, security teams, and developers using the Unpublished Node Permissions module should assess exposure and take necessary actions to prevent potential access bypass.

Why it matters

CVE-2026-84920 is an Incorrect Authorization vulnerability in Unpublished Node Permissions for Drupal, allowing Forceful Browsing. Site administrators and security teams should verify exposure and apply patches due to potential access bypass risks. The vulnerability affects versions from 0.0.0 to 1.8.0, and its impact requires verification from official sources.

  • Potential access bypass due to Incorrect Authorization vulnerability.
  • Need for verification of affected versions and exposure.
  • Prioritization of patching or updating to version 1.8.0 or higher.

Technical summary

The Unpublished Node Permissions module for Drupal has an Incorrect Authorization vulnerability, allowing for Forceful Browsing. The issue affects versions from 0.0.0 to 1.8.0. Site administrators should verify exposure and apply patches to mitigate potential access bypass risks.

Defensive priority

Drupal site administrators and security teams should prioritize verifying exposure and applying patches due to potential access bypass risks.

Recommended defensive actions

  • Verify if the Unpublished Node Permissions module is installed and enabled on Drupal sites.
  • Check if the installed version is within the affected range (0.0.0 to 1.8.0).
  • Apply the latest patch or update to version 1.8.0 or higher if necessary.
  • Monitor for potential access bypass attempts on Drupal sites.

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional verification is needed to confirm affected versions and potential impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-84920 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-84920

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-84920 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-84920

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.