---
id: "CVE-2026-107311"
kind: "vulnerability"
aliases: ["CVE-2026-107311"]
title: "Drupal Permissions by Term: forceful browsing exposes restricted content"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "permissions-by-term", "self-hosted"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-30T04:17:58+00:00"
first_seen_at: "2026-10-30T04:28:36+00:00"
updated_at: "2026-10-30T04:31:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107311", "first_seen_at": "2026-10-30T04:28:36+00:00"}]
---

# Drupal Permissions by Term: forceful browsing exposes restricted content

Permissions by Term, a Drupal module that controls access to content by taxonomy term, has an improper check for unusual conditions that allows forceful browsing. An attacker can reach pages they should not see by requesting them directly.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed `permissions_by_term` module version in the Drupal project (for example with `composer show drupal/permissions_by_term`).

## Fix

- Versions from 0.0.0 to 3.1.41 are affected; move to a later release than `3.1.41`.
- Fixed version not stated in the sources beyond that range.

## Timeline

- 2026-10-30T04:28:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107311

## From the sources

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_