PT-2026-28676 · Drupal · Drupal

Andre Groendijk + 4 · Published 2026-03-11 · Updated 2026-03-26 · CVE-2026-4933

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 1.7.0

Description An incorrect authorization issue exists in Drupal’s Unpublished Node Permissions, allowing forceful browsing. The problem relates to inconsistent access control for unpublished translated nodes. The module, designed to manage permissions for unpublished nodes per content type, does not consistently enforce these controls.

Recommendations Update to version 1.7.0 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-4933

DRUPAL-CONTRIB-2026-029

Affected Products

Drupal

References · 4

• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-029 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4933 · Security Note
• https://drupal.org/sa-contrib-2026-029 · Vendor Advisory
• https://twitter.com/CVEnew/status/2037280541452755001 · Twitter Post