CVE-2026-8491: Drupal Node View Permissions Auth Bypass

CVE-2026-8491 Overview

CVE-2026-8491 affects the Drupal Node View Permissions contributed module. The flaw stems from an Improper Check for Unusual or Exceptional Conditions [CWE-754] that allows forceful browsing. Unauthenticated attackers can request node URLs directly and bypass intended access restrictions under specific conditions, leading to limited information disclosure.

The issue affects Node View Permissions versions prior to 1.7.0 and versions 2.0.0 before 2.0.1. The vulnerability is network-reachable but requires high attack complexity, and impact is limited to confidentiality of low-sensitivity node content.

Critical Impact

Attackers can enumerate and read node content that should be restricted by the module's view permissions, exposing limited information without authentication.

Affected Products

• Drupal Node View Permissions module versions 0.0.0 through 1.6.x
• Drupal Node View Permissions module version 2.0.0
• Drupal sites using the module to enforce per-content-type view restrictions

Discovery Timeline

• 2026-05-19 - CVE-2026-8491 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-8491

Vulnerability Analysis

The Node View Permissions module extends Drupal core by adding view own and view any permissions for each content type. CVE-2026-8491 occurs because the module fails to validate an exceptional access path, allowing forceful browsing to retrieve node content the user should not view.

Forceful browsing attacks manipulate URLs to access resources directly, bypassing navigation-layer controls. In this case, an attacker requests a known or guessed node identifier such as /node/{nid} and the module does not properly reject the request when its permission check encounters an unexpected condition.

The exposure is limited to confidentiality. Attackers cannot modify content or affect availability through this flaw. Exploitation requires the target site to use the affected module and have content restricted by its permission grants.

Root Cause

The root cause is an Improper Check for Unusual or Exceptional Conditions [CWE-754]. The module's permission grant logic does not handle every code path correctly, so the absence of a granted permission is treated as access allowed in certain edge cases rather than denied by default.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker iterates node identifiers or uses sitemap and search engine data to enumerate restricted nodes. Each request bypasses the intended view permission check and returns content that should be hidden. High attack complexity reflects the specific configuration conditions required for the bypass to succeed.

No public proof-of-concept code is available. Refer to the Drupal Security Advisory SA-CONTRIB-2026-034 for vendor technical details.

Detection Methods for CVE-2026-8491

Indicators of Compromise

• Sequential or enumerated requests to /node/{nid} paths from a single source address, particularly targeting node IDs that should be restricted
• HTTP 200 responses for nodes that should return 403 based on the requesting user's role
• Anonymous user sessions accessing content types protected by view any content or view own content permissions

Detection Strategies

• Review Drupal access logs and web server logs for anonymous reads against content types restricted by the Node View Permissions module
• Audit the installed module version using drush pm:list --type=module --status=enabled and flag any host running a version below 1.7.0 or equal to 2.0.0
• Compare expected versus observed response codes for restricted nodes by replaying anonymous requests against a representative set of node IDs

Monitoring Recommendations

• Alert on high request rates to /node/* paths from unauthenticated clients
• Track changes to module version inventories across the Drupal estate to confirm patch deployment
• Monitor referer and user-agent patterns associated with content scraping that could exploit forceful browsing

How to Mitigate CVE-2026-8491

Immediate Actions Required

• Update the Node View Permissions module to version 1.7.0 or 2.0.1 depending on the major branch in use
• Inventory all Drupal sites and confirm whether the module is enabled before applying remediation
• After patching, clear the Drupal cache and rebuild permissions with drush cache:rebuild

Patch Information

The Drupal security team released fixed versions 1.7.0 and 2.0.1. Site administrators should consult the Drupal Security Advisory SA-CONTRIB-2026-034 for the authoritative patch notes and upgrade procedure.

Workarounds

• Temporarily disable the Node View Permissions module and rely on Drupal core access controls or an alternative access module until patching is complete
• Restrict anonymous access to affected content types through web application firewall rules that deny /node/{nid} requests for sensitive ranges
• Require authenticated access at the reverse proxy layer for content paths protected by the module

# Configuration example: update the module with Composer and Drush
composer update drupal/node_view_permissions --with-dependencies
drush updatedb -y
drush cache:rebuild
drush pm:list --type=module --status=enabled | grep node_view_permissions