{"id":"CVE-2026-107311","kind":"vulnerability","aliases":["CVE-2026-107311"],"related":[],"title":"Drupal Permissions by Term: forceful browsing exposes restricted content","description":"Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.","summary":"Permissions by Term, a Drupal module that controls access to content by taxonomy term, has an improper check for unusual conditions that allows forceful browsing. An attacker can reach pages they should not see by requesting them directly.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","permissions-by-term","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed `permissions_by_term` module version in the Drupal project (for example with `composer show drupal/permissions_by_term`).","fix":"- Versions from 0.0.0 to 3.1.41 are affected; move to a later release than `3.1.41`.\n- Fixed version not stated in the sources beyond that range.","status":"open","published_at":"2026-10-30T04:17:58+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","triaged_at":"2026-10-30T04:31:22+00:00","updated_at":"2026-10-30T04:31:22+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:31:22Z","model":"claude-haiku-5-5","output":{"fix":"- Versions from 0.0.0 to 3.1.41 are affected; move to a later release than `3.1.41`.\n- Fixed version not stated in the sources beyond that range.","reach":"internet","title":"Drupal Permissions by Term: forceful browsing exposes restricted content","impact":"medium","summary":"Permissions by Term, a Drupal module that controls access to content by taxonomy term, has an improper check for unusual conditions that allows forceful browsing. An attacker can reach pages they should not see by requesting them directly.","audience":"developers","category":"package","nicknames":[],"who_cares":["drupal","permissions-by-term","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Restricted content readable by users who should not see it","analyst_note":"Check the Drupal security advisory for the fixed version and whether authentication or a specific configuration is needed.","how_to_check":"- Check the installed `permissions_by_term` module version in the Drupal project (for example with `composer show drupal/permissions_by_term`).\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that use the Permissions by Term module to restrict access to content by taxonomy term are exposed. Sites without this module installed are not affected. The sources do not say whether a specific configuration is required to trigger the flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000679,"input_tokens":4103,"output_tokens":537,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107311':12A,15A '-2026':11A,14A '0.0.0':87C '3.1.41':89C 'access':33B 'affect':81C 'allow':47B,76C 'attack':51B 'brows':6A,49B,78C 'check':42B,64C 'condit':45B,69C 'content':9A,35B 'control':32B 'cve':10A,13A 'direct':62B 'drupal':1A,16B,29B,72C 'except':68C 'expos':7A 'forc':5A,48B,77C 'host':24B 'improp':41B,63C 'issu':80C 'modul':30B 'packag':17B 'page':54B 'permiss':2A,19B,25B,73C,82C 'permissions-by-term':18B 'reach':53B 'request':60B 'restrict':8A 'see':58B 'self':23B 'self-host':22B 'taxonomi':37B 'term':4A,21B,27B,38B,75C,84C 'unusu':44B,66C 'version':85C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that use the Permissions by Term module to restrict access to content by taxonomy term are exposed. Sites without this module installed are not affected. The sources do not say whether a specific configuration is required to trigger the flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T04:17:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107311","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107311","severity":null,"published_at":"2026-10-30T04:17:58+00:00","modified_at":"2026-10-30T04:17:58+00:00","first_seen_at":"2026-10-30T04:28:36+00:00","fetched_at":"2026-10-30T04:28:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}