This vulnerability (CVE-2026-8491) in Drupal's Node View Permissions module is classified under CWE-754, indicating an improper check for unusual or exceptional conditions. It allows forceful browsing by bypassing intended access controls on node views. Affected versions include those before 1.7.0 in the 0.0.0 series and before 2.0.1 in the 2.0.0 series. The CVSS 3.1 base score is 3.7, reflecting a low severity impact with network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality impact. There is no vendor advisory or patch link available, and the remediation level is unspecified.

The impact is limited to unauthorized viewing of content nodes due to improper permission checks, resulting in a confidentiality impact rated as low. There is no impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to sensitive nodes through alternative access control mechanisms or monitoring for unusual access patterns related to node views.