CVE-2026-8491

Vulnerability

Overview

The Node View Permissions module for Drupal provides per-content-type view permissions such as "View own content" and "View any content". A vulnerability exists due to an improper check for unusual or exceptional conditions when a user account is cancelled and their content is reassigned to the anonymous user. The module does not sufficiently handle this reassignment, leading to a forceful browsing issue [1].

Exploitation

Conditions

Exploitation is limited to private content where the anonymous user should not normally have view access. The attack surface is further constrained to nodes that have been reassigned to the anonymous user, typically after a user cancellation. No authentication is required for the anonymous user to attempt viewing such content [1].

Impact

An anonymous attacker can bypass intended access restrictions and view private content that should be hidden. This constitutes an access bypass vulnerability, potentially exposing sensitive information [1].

Mitigation

The vulnerability is patched in Node View Permissions versions 1.7.0 (for the 8.x-1.x branch) and 2.0.1 (for the 2.x branch). Users running earlier versions should upgrade immediately. No workaround is provided in the advisory [1].