{
  "id": 16019671,
  "title": "Your Drupal node page says 403. Your RSS feed doesn't care",
  "url": "https://urgent.news/2026/10/22/your-drupal-node-page-says-403-your-rss-feed-doesnt-care",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-22T08:47:32.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/yakoveka/your-drupal-node-page-says-403-your-rss-feed-doesnt-care-4m5g"
  },
  "original_language": "en",
  "account": "A bug was encountered where private content was leaking through the RSS feed, despite a node access hook being in place. When the node was opened directly, a 403 error was returned, as intended. However, the same content was accessible via the RSS feed, search results and taxonomy term pages, available to anyone. The issue was not with the node access hook, but rather with Drupal's two separate access systems that do not communicate with each other. This article demonstrates the difference between single-entity access and query access, and explains how to fix the issue using node grants.",
  "summary": "I ran into a bug where private content leaked even though a node access hook was already in place. Opening the node directly returned 403, exactly as intended. But the same content was sitting in the RSS feed, in search results and on taxonomy term pages, available to anyone. The hook wasn't broken. It checks permissions when someone visits the node page, and on those pages nobody was visiting…",
  "key_points": [
    "Private content leaked through RSS feed",
    "Node access hook ineffective",
    "Drupal's access systems not synchronized"
  ],
  "editors_take": "The disconnect between single-entity access and query access creates critical security vulnerabilities by allowing private content to bypass standard permission checks through secondary discovery channels like RSS feeds.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}