Taxonomy Term Glossary CVE-2026-87954

Exploitation requires an authenticated session on the Drupal site: the CVSS vector specifies PR:L, so a valid low-privileged account is needed, and the attacker then performs forceful browsing - directly requesting taxonomy term glossary resources whose access controls are missing (CWE-862) - to view content they should not reach. The specific URLs, routes, or module configuration that expose the restricted terms are not described in the available sources. Limiting factors: authentication is required (not anonymous), impact is confined to confidentiality (C:L; no integrity or availability effect), and only the Taxonomy Term Glossary contrib module versions below 4.6.0 are affected, so upgrading to 4.6.0 removes the condition.

This is a moderate-severity information-disclosure issue, not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, base 4.3) indicates a network-reachable flaw that is low-complexity but requires an authenticated low-privileged account (PR:L) and yields only limited confidentiality impact (C:L/I:N/A:N) - consistent with CWE-862 Missing Authorization and the 'Forceful Browsing' behavior described. The decision signals align toward low urgency: EPSS is 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit or PoC reference is present, so exploitation is neither confirmed nor demonstrated. The vuln.today priority label is 'this_month', which matches a patch-when-convenient posture rather than act_now/emergency. The only point of friction is the input Tag 'Authentication Bypass', which conflicts with the CWE-862 Missing Authorization classification and the description - this is an authorization (access-control) weakness, not an authentication bypass; treat the tag with caution. Net: a genuine but low-priority access-control bug affecting a niche Drupal contrib module.

An attacker who already holds a low-privileged authenticated account on the Drupal site directly requests taxonomy term glossary URLs or endpoints that should be access-restricted, and the missing authorization check lets them view term data they were not authorized to see. No public exploit or PoC reference is provided, and impact is limited to disclosure of information (no modification or denial of service).