View unpublished: This module allows granting access to unpublished nodes per content type. (CVE-2026-114537)
Description
The View unpublished module for Drupal allows users with the "access content" permission to view published translations of nodes that have at least one unpublished translation, bypassing other node access restrictions. This issue requires a multilingual site with nodes having both unpublished and published translations, and the presence of other node access modules restricting view access. A fix is available for this vulnerability.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The View unpublished module grants users with the "access content" permission view access to published translations of nodes that have at least one unpublished translation. This behavior overrides restrictions imposed by other node access modules like Content Access or Domain Access. The vulnerability is conditional on the site being multilingual, nodes having both unpublished and published translations, and other node access modules restricting access to the published translations. The affected versions are all versions prior to 1.5.0. A patch is available to address this issue.
Potential Impact
Users with the "access content" permission may bypass node access restrictions on published translations of nodes that have unpublished translations, potentially exposing content that should be restricted by other access control modules. The impact is limited by the requirement for a multilingual site and specific node translation states.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade to version 1.5.0 or later of the View unpublished module to remediate this issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- DRUPAL-CONTRIB-2026-235
- Osv Schema Version
- 1.7.0
- Aliases
- ["CVE-2026-114537"]
- Ecosystems
- ["Packagist:https://packages.drupal.org/8"]
Threat ID: 6ad91ca84d27ba8daafa91b9
Added to database: 10/21/2026, 20:12:24 UTC
Last enriched: 10/21/2026, 20:14:08 UTC
Last updated: 10/21/2026, 20:14:08 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.