CVE-2026-114537 in View Unpublished Module
Summary
by MITRE • 10/30/2026
Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The View Unpublished module for Drupal, specifically within the version range of 0.0.0 through 1.5.0, contains a critical access control flaw that permits unauthorized users to view content explicitly marked as unpublished or private. This vulnerability stems from an incorrect authorization check implemented in the module's rendering logic, which fails to properly validate user permissions before serving node data to the client. In standard Drupal architecture, nodes with a status of zero are intended to be invisible to all non-administrative users and even many administrative roles unless they possess specific bypass privileges. However, due to this defect, the system does not enforce these restrictions during the retrieval process, effectively allowing any authenticated user or potentially anonymous visitors depending on site configuration to access sensitive information that was deliberately withheld from public view.
This technical flaw represents a classic case of broken object level authorization where the application logic relies on superficial checks rather than robust permission validation at the data layer. The vulnerability aligns with CWE-284, which describes Improper Access Control, and can be categorized under MITRE ATT&CK technique T1078, Valid Accounts, as it allows attackers to leverage existing credentials or even public access vectors to retrieve restricted resources. By exploiting this weakness, an attacker can perform forceful browsing against unpublished nodes, extracting confidential data such as draft articles, internal communications, personal information of users, or proprietary business details that were never intended for disclosure. The impact is severe because it undermines the fundamental trust model of content management systems where editorial workflows rely on strict separation between drafts and published material.
The operational consequences of this vulnerability extend beyond simple data leakage. It can lead to significant reputational damage if sensitive internal documents are exposed, potential regulatory violations involving privacy laws such as GDPR or HIPAA depending on the nature of the leaked data, and a loss of confidence in the platform's security posture among administrators and end-users. Attackers may use automated scripts to iterate through node IDs systematically, harvesting large volumes of unpublished content with minimal effort once they identify valid endpoints within the Drupal site structure. This ease of exploitation makes it particularly dangerous for sites that handle sensitive information or rely on pre-release content management features.
To mitigate this risk, organizations running affected versions must immediately upgrade the View Unpublished module to version 1.5.1 or later where the authorization checks have been corrected to properly enforce access controls based on user roles and permissions. Until an update is applied, administrators should consider implementing web application firewall rules that monitor for unusual patterns of node ID enumeration targeting unpublished content types. Additionally, reviewing site configuration to ensure that no other modules are inadvertently bypassing these restrictions can help reduce the attack surface. Regular security audits and penetration testing focused on access control mechanisms are recommended to identify similar flaws in custom code or contributed modules within the Drupal ecosystem.