PT-2026-28676

CVE-2026-4933

Published

2026-03-11

Updated

2026-03-26

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 1.7.0

Description An incorrect authorization issue exists in Drupal’s Unpublished Node Permissions, allowing forceful browsing. The problem relates to inconsistent access control for unpublished translated nodes. The module, designed to manage permissions for unpublished nodes per content type, does not consistently enforce these controls.

Recommendations Update to version 1.7.0 or later.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products