Permissions By Term
Monthly
Access bypass in the Drupal contrib module Permissions by Term (versions 0.0.0 through 3.1.41) allows remote visitors to read nodes that taxonomy-term-based access rules are meant to hide, a limited information disclosure scored CVSS 3.7 (C:L, no integrity or availability impact). Only Drupal sites that run the module and actually enforce term-based node access are exposed, and exploitation depends on reaching a specific exceptional condition in the access check whose trigger is not described in the available sources, which is why attack complexity is rated high. No public exploit code was identified at time of analysis, EPSS is 0.15% (4th percentile), SSVC reports Exploitation: none and Automatable: no, and the vuln.today decision label is monitor.
Access bypass in the Drupal contrib module Permissions by Term (versions 0.0.0 through 3.1.41) allows remote visitors to read nodes that taxonomy-term-based access rules are meant to hide, a limited information disclosure scored CVSS 3.7 (C:L, no integrity or availability impact). Only Drupal sites that run the module and actually enforce term-based node access are exposed, and exploitation depends on reaching a specific exceptional condition in the access check whose trigger is not described in the available sources, which is why attack complexity is rated high. No public exploit code was identified at time of analysis, EPSS is 0.15% (4th percentile), SSVC reports Exploitation: none and Automatable: no, and the vuln.today decision label is monitor.