This vulnerability (CVE-2026-4933) in Drupal's Unpublished Node Permissions module is due to incorrect authorization controls (CWE-863). It allows an attacker to bypass access restrictions and perform forceful browsing to access unpublished nodes. The affected versions include 0.0.0 before 1.7.0. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low complexity, no privileges required, no user interaction, and a high confidentiality impact. No patch or vendor advisory information is provided, so remediation status is unknown.

Successful exploitation could allow an unauthenticated attacker to access unpublished content that should be restricted, leading to unauthorized disclosure of sensitive information. There is no indication of impact on integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the Drupal vendor advisory for current remediation guidance. Until an official fix is available, restrict access to Drupal instances and monitor for unusual access patterns to unpublished content. Avoid exposing Drupal administrative interfaces publicly.