This vulnerability is an incorrect authorization flaw in Drupal's Unpublished Node Permissions module that permits unauthenticated users to forcefully browse URLs and view content that should remain unpublished. The weakness, classified as CWE‑863, can lead to the disclosure of sensitive information that was intended to be restricted to certain user roles.

Drupal’s Unpublished Node Permissions module versions 0.0.0 through 1.8.0 are affected. Administrators should verify which exact release they are running and plan to update or disable the module accordingly.

Because the module’s URLs are publicly accessible, an attacker can exploit the flaw over the network without any authentication. The CVSS score of 5.3 indicates moderate severity, and the EPSS score of <1% shows a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Although the advisory labels it critical, the impact is primarily an unauthorized disclosure of unpublished content. The risk is elevated for sites that expose confidential or regulated content before publication.