Forceful Browsing in Drupal Node View Permissions

Publication date: 2026-05-19

Last updated on: 2026-05-27

Assigner: Drupal.org

Description

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Node View Permissions allows Forceful Browsing. This issue affects Node View Permissions: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-19

Last Modified

2026-05-27

Generated

2026-06-30

AI Q&A

2026-05-20

EPSS Evaluated

2026-06-28

NVD

CVE-2026-8491

EUVD

EUVD-2026-30991

Affected Vendors & Products

Vendor	Product	Version / Range
adcisolutions	node_view_permissions	to 1.7 (exc)
adcisolutions	node_view_permissions	2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-754	The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Attack-Flow Graph

Executive Summary

This vulnerability is an Improper Check for Unusual or Exceptional Conditions in Drupal Node View Permissions, which allows Forceful Browsing.

Impact Analysis

The vulnerability allows Forceful Browsing, which means an attacker could potentially access content or nodes they are not authorized to view by bypassing normal permission checks.

Hi! I’m here to help you understand CVE-2026-8491. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70