CVE-2026-8491— Node View Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-034
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Drupal | Node View Permissions | 0.0.0< 1.7.0 | affected |
2.0.0< 2.0.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-8491
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Node View Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-034
Source: NVD (National Vulnerability Database)
Vulnerability Description
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Node View Permissions allows Forceful Browsing. This issue affects Node View Permissions: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.1.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对因果或异常条件的不恰当检查
Source: NVD (National Vulnerability Database)
Vulnerability Title
Drupal Node View Permissions 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Drupal Node View Permissions是Drupal公司的一个Drupal内容访问控制模块。 Drupal Node View Permissions存在代码问题漏洞，该漏洞源于异常或特殊情况检查不当，可能导致强制浏览。以下版本受到影响：1.7.0之前版本和2.0.0至2.0.1之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Drupal | Node View Permissions | 0.0.0 ~ 1.7.0 | - |
II. Public POCs for CVE-2026-8491
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-8491
请登录查看更多情报信息。
Advisory · 1
Same Patch Batch · Drupal · 2026-05-19 · 9 CVEs total
| CVE-2026-8495 | Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037 | |
| CVE-2026-8493 | Colorbox Inline - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-036 | |
| CVE-2026-8492 | Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA | |
| CVE-2026-6871 | Obfuscate - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-033 | |
| CVE-2026-6367 | Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-003 | |
| CVE-2026-6366 | Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002 | |
| CVE-2026-6365 | Drupal core - Critical - Cross-site scripting - SA-CORE-2026-001 | |
| CVE-2026-6095 | Orejime - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-032 |
IV. Related Vulnerabilities
Same vendor: Drupal
- CVE-2026-4093
Stored XSS in Drupal 7 Term Reference Tree module (token dis - CVE-2026-4929
Simple Hierarchical Select (Drupal 7) XSS in term-derived ou - CVE-2026-9082
Drupal core - Highly critical - SQL injection - SA-CORE-2026 - CVE-2026-8495
Date iCal - Critical - Information disclosure - SA-CONTRIB-2 - CVE-2026-8493
Colorbox Inline - Moderately critical - Cross-site scripting
Same weakness: CWE-754
- CVE-2026-40094
nimiq-blockchain: network-libp2p untrusted peer can crash ad - CVE-2026-47315
SAMSUNG Escargot 代码问题漏洞 - CVE-2026-4643
Calling window.close() from server-side content causes crash - CVE-2026-4054
SVG content served through Mattermost image proxy despite Co - CVE-2026-0241
Trust Protection Foundation: Multiple Authorization Bypass V
V. Comments for CVE-2026-8491
No comments yet