EUVD-2026-113561
GHSA-wm34-8fvp-f9p7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify term-restricted node URL
-
ExploitRequest node directly bypassing term check
-
ImpactView restricted content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Unusual condition handling
|
| Exploitation Conditions | Requires a Drupal site running the Permissions by Term contrib module (versions 0.0.0 through 3.1.41) and configured to restrict node access by taxonomy term - without that configuration there is nothing to bypass. Exploitation is limited by high attack complexity (AC:H): the attacker must reach the specific exceptional/error condition under which the term-based access check is not applied, and that trigger is not described in the available sources. No authentication is required (PR:N) and no user interaction is needed (UI:N), but impact is confined to disclosure of term-protected content (C:L); integrity and availability are unaffected. |
| Impact | This is a low-severity, low-priority issue and the signals are consistent rather than conflicting. The CVSS 3.1 base score is 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/C:L/I:N/A:N - network-reachable and unauthenticated, but high attack complexity and only limited confidentiality impact (no integrity or availability impact). EPSS is 0.15% (4th percentile), indicating very low modeled exploitation probability. The vulnerability is NOT in CISA KEV, SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial, and the vuln.today Decision label is 'monitor'. There is no public exploit identified at time of analysis - the only references are the Drupal security advisory (SA-contrib-2026-214) and the NVD entry. All signals agree this is a genuinely low-risk forceful-browsing/information-disclosure flaw in a Drupal contrib access-control module, not a high-CVSS-but-overstated issue - the CVSS itself is low. The main caveat is that the AC:H rating and the exact trigger condition are not explained in the available sources, so the precise circumstances under which term-based restrictions fail are not confirmed. |
| Exploit ScenarioDerived | An unauthenticated attacker who knows or guesses the URL of a node that should be hidden by Permissions by Term requests it directly; under the exceptional condition that is not detailed in the sources, the module fails to enforce the taxonomy-term access check and the restricted content is disclosed. No public exploit code is identified, and the high attack complexity means exploitation is not reliably repeatable against arbitrary content. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Access bypass in the Drupal contrib module Permissions by Term (versions 0.0.0 through 3.1.41) allows remote visitors to read nodes that taxonomy-term-based access rules are meant to hide, a limited information disclosure scored CVSS 3.7 (C:L, no integrity or availability impact). Only Drupal sites that run the module and actually enforce term-based node access are exposed, and exploitation depends on reaching a specific exceptional condition in the access check whose trigger is not described in the available sources, which is why attack complexity is rated high. No public exploit code was identified at time of analysis, EPSS is 0.15% (4th percentile), SSVC reports Exploitation: none and Automatable: no, and the vuln.today decision label is monitor.
RemediationAI
A vendor patch is available: Drupal has published a security advisory for the Permissions by Term module at https://www.drupal.org/sa-contrib-2026-214, which identifies the fixed release, and the remediation is to update the module to a version later than 3.1.41 as specified in that advisory (the exact fixed version number is stated in the advisory rather than in the supplied data). Because the defect only manifests on sites that restrict node access by taxonomy term, those sites should treat the update as the complete fix and prioritise it over sites where the module is installed but not enforcing term-based restrictions. If an update cannot be applied immediately, the only structural workaround consistent with the flaw is to stop relying on term-based node access for sensitive content - disabling the module removes the term-based filtering entirely, so any content currently protected only by that filtering would become publicly visible and must be protected by another mechanism first. The vendor advisory is the authoritative source for version guidance and any further instructions it contains; SSVC rates this as Exploitation: none, Automatable: no, Technical Impact: partial, and the vuln.today priority is monitor.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Drupal's access control layer decides whether a user may view, edit or delete a node, and contributed modules can add their own rules through that system. Permissions by Term extends this by tying node visibility to the taxonomy terms attached to the node, so that content tagged with a given term is restricted to selected roles or users. The flaw is classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions): an error or otherwise exceptional code path is handled without the term-based access decision being applied, so a request that reaches that path returns content the caller should not see. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N confirms this is remotely reachable without privileges or user interaction, but with high attack complexity and impact confined to confidentiality of term-protected content; the exact trigger condition and the code path involved are not described in the available sources. CPE cpe:2.3:a:drupal:permissions_by_term identifies the affected component as the contributed module rather than Drupal core.
Know when Permissions By Term gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network request (AV:N/PR:N/UI:N) but an exceptional, non-trivially-reached condition yields AC:H; only term-restricted content is disclosed, so C:L and I:A none.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
3DescriptionCVE.org
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB