{"id":"DRUPAL-CONTRIB-2026-214","aliases":["CVE-2026-107311"],"title":"This module enables you to restrict view access to single nodes via taxonomy terms.","titleSource":"OSV","descriptionSource":"OSV","description":"This module enables you to restrict view access to single nodes via taxonomy terms.\n\nThe module doesn't sufficiently check access rights when in \"Permission mode\" and a node referencing a deleted taxonomy term is accessed via JSON:API.\n\nThis vulnerability is mitigated by the fact that it requires a specific module configuration, references to a deleted term, and access via JSON:API to be present.","severity":"low","score":3.7,"published":"2026-10-07T16:39:13.000Z","modified":"2026-10-30T20:38:03.847Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist:https://packages.drupal.org/8","name":"drupal/permissions_by_term","sources":[{"name":"OSV · DRUPAL-CONTRIB-2026-214","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-214"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"3.1.41"}],"type":"ECOSYSTEM","database_specific":{"constraint":"<3.1.41"}}],"versions":[],"fixed":["3.1.41"]}],"sourceAffected":[],"references":["https://www.drupal.org/sa-contrib-2026-214"],"sources":[{"name":"OSV","id":"DRUPAL-CONTRIB-2026-214","modified":"2026-10-07T20:15:05.830844274Z","url":"https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-214"},{"name":"CVE","id":"CVE-2026-107311","modified":"2026-10-30T20:38:03.847Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-107311"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","score":3.7}],"cve":{"records":[{"id":"CVE-2026-107311","source":"drupal","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-07T16:30:25.712Z","published":"2026-10-30T03:10:00.554Z","modified":"2026-10-30T20:38:03.847Z"}],"publishers":[{"name":"drupal","role":"CNA","organizationId":"2c85b837-eb8b-40ed-9d74-228c62987387","modified":"2026-10-30T03:10:00.554Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T20:38:03.847Z"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-214","tags":[],"source":"drupal"}],"weaknesses":[{"id":"CWE-754","description":"CWE-754 Improper Check for Unusual or Exceptional Conditions","source":"drupal"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T20:37:59.511561Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"products":[{"vendor":"Drupal","name":"Permissions by Term","platforms":[],"versions":[{"version":"0.0.0","status":"affected","lessThan":"3.1.41","versionType":"semver"}],"cpes":[],"source":"drupal","url":"https://www.cve.org/CVERecord?id=CVE-2026-107311"}],"remediation":[],"observedAt":"2026-10-30T21:22:57.551Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T12:55:32.908Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-30T04:05:36.646Z","attemptedAt":"2026-10-30T04:05:36.646Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T04:05:36.506Z","attemptedAt":"2026-10-30T04:05:36.506Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T04:05:36.504Z","attemptedAt":"2026-10-30T04:05:36.504Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T04:05:36.733Z","attemptedAt":"2026-10-30T04:05:36.733Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113561","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113561","modified":"Oct 30, 2026, 3:10:00 AM","checkedAt":"2026-10-30T04:05:36.504Z"}],"aiSummary":null}