Taxonomy Term Glossary
Monthly
Authenticated low-privileged users can read restricted taxonomy term glossary content on Drupal sites running the Taxonomy Term Glossary contrib module before 4.6.0, because directly requested glossary resources lack authorization checks. The issue is CWE-862 missing authorization, rated CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), so exploitation needs a valid account and affects confidentiality only. EPSS is 0.15% (4th percentile); no public exploit identified at time of analysis, no CISA KEV entry is indicated, and a vendor patch is available.
Authenticated low-privileged users can read restricted taxonomy term glossary content on Drupal sites running the Taxonomy Term Glossary contrib module before 4.6.0, because directly requested glossary resources lack authorization checks. The issue is CWE-862 missing authorization, rated CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), so exploitation needs a valid account and affects confidentiality only. EPSS is 0.15% (4th percentile); no public exploit identified at time of analysis, no CISA KEV entry is indicated, and a vendor patch is available.