The Unpublished Node Permissions module in Drupal contains an incorrect authorization flaw that allows attackers to circumvent normal access controls and retrieve content that should remain hidden from non‑privileged users. This weakness falls under CWE‑863 and enables forceful browsing, letting an attacker read unpublished nodes by requesting their URLs. Consequently, sensitive or unpublished information may be exposed to unauthenticated parties, compromising confidentiality.

Drupal installations that have the Unpublished Node Permissions contributed module installed at any version from 0.0.0 up to, but not including, 1.7.0 are affected. The issue applies to all sites using these older versions, regardless of the content type or publishing workflow.

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The flaw is not listed in the CISA KEV catalog, and no other major exploits are publicly documented. Based on the description, the likely attack vector involves sending crafted HTTP GET requests to suspected unpublished node URLs, which, when successful, return the full node content without authentication.