Project:
Project machine name:
permissions_by_termDate:
2026-October-07
Security risk:
Vulnerability:
Information disclosure
Affected versions:
<3.1.41
CVE IDs:
CVE-2026-107311
Description:
This module enables you to restrict view access to single nodes via taxonomy terms.
The module doesn't sufficiently check access rights when in "Permission mode" and a node referencing a deleted taxonomy term is accessed via JSON:API.
This vulnerability is mitigated by the fact that it requires a specific module configuration, references to a deleted term, and access via JSON:API to be present.
Solution:
Install the latest version:
- If you use the Permissions by Term module, upgrade to Permissions by Term 3.1.41
Reported By:
Coordinated By:
- Swan Kalata (akalata) of the Drupal Security Team
- Damien McKenna (damienmckenna) of the Drupal Security Team
- Juraj Nemec (poker10) of the Drupal Security Team
- Pierre Rudloff (prudloff) of the Drupal Security Team
