This module allows granting access to unpublished nodes per content type. For nodes with at least one unpublished translation, the module grants every user wit...

On multilingual sites, this flaw lets users with the access content permission view published translations that another node access module would normally restrict. It occurs when the same node has at least one unpublished translation as well as a published translation. Restrictions from modules such as Content Access or Domain Access can be overridden.

Check composer.lock for drupal/view_unpublished and its installed version. The advisory lists 1.5.0 as fixed but gives no affected version range. Check whether your site is multilingual, whether any node has both published and unpublished translations, and whether another node access module restricts viewing those published translations. Users with the access content permission are the users who can gain access.

The vulnerability is mitigated by requiring all three conditions: a multilingual site, a node with both unpublished and published translations, and another node access module restricting view access to the published translations.

This module allows granting access to unpublished nodes per content type.

For nodes with at least one unpublished translation, the module grants every user with the "access content" permission view access to the published translations of that node. This overrides the restrictions of other node access modules, such as Content Access or Domain Access, that might have been in place for these translations.

This vulnerability is mitigated by the fact that the site must be multilingual, a node must have both unpublished and published translations, and another node access module must restrict view access to the published translations.