Executive brief
The Node View Permissions module for Drupal, which manages who can see specific website content, contains a security flaw. Under specific conditions—specifically when a user account is deleted and their private content is reassigned to an anonymous guest—unauthorized visitors may be able to view that private content. This could lead to the exposure of sensitive information that was intended to remain restricted.
Technical details
An access bypass vulnerability exists in the Drupal Node View Permissions module due to improper handling of exceptional conditions (CWE-754). Specifically, the module fails to correctly enforce access controls when a user account is cancelled and its associated content is reassigned to the 'anonymous' user. An attacker can exploit this via forceful browsing to access private nodes that should remain restricted. The vulnerability is mitigated by the requirement that content must have been reassigned to the anonymous user and must be of a type where anonymous users typically lack view access. Patches are available in versions 1.7.0 and 2.0.1.
Affected products
- Drupal Node View Permissions <1.7.0, >=2.0.0 <2.0.1
Timeline
- 2026-05-13: advisory: Drupal security advisory SA-CONTRIB-2026-034 published
- 2026-05-19: disclosed: CVE-2026-8491 published to NVD