{"id":"DRUPAL-CONTRIB-2019-093","aliases":[],"title":"This module extends access handling of Drupal Core's Taxonomy module.","titleSource":"OSV","descriptionSource":"OSV","description":"This module extends access handling of Drupal Core's Taxonomy module.\n\nThe module doesn't sufficiently check,\n\n* if a given entity should be access controlled, defaulting to allowing access even to unpublished Taxonomy Terms.\n* if certain administrative routes should be access controlled, defaulting to allowing access even to users without permission to access these administrative routes.\n\nThe vulnerability is mitigated by the facts, that\n\n* the user interface to change the status of Taxonomy Terms has been released in Drupal Core 8.8 and a custom or contributed module is required in earlier versions of Drupal Core to mark Taxonomy Terms as unpublished.\n* all entity operations (except the view operation) available on affected administrative routes still require appropriate permissions.\n* an attacker must have a role with permission to either access content or view a Taxonomy Term in a vocabulary.","severity":"unknown","score":null,"published":"2019-12-11T18:32:17.000Z","modified":"2026-09-10T03:46:15.260Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist:https://packages.drupal.org/8","name":"drupal/taxonomy_access_fix","sources":[{"name":"OSV · DRUPAL-CONTRIB-2019-093","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2019-093"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.7.0"}],"type":"ECOSYSTEM","database_specific":{"constraint":"<2.7.0"}}],"versions":[],"fixed":["2.7.0"]}],"sourceAffected":[],"references":["https://www.drupal.org/sa-contrib-2019-093"],"sources":[{"name":"OSV","id":"DRUPAL-CONTRIB-2019-093","modified":"2026-09-10T03:46:15.260505866Z","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2019-093"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"unavailable","checkedAt":"2026-10-29T00:55:32.564Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}