{"id":"CVE-2026-87954","kind":"vulnerability","aliases":["CVE-2026-87954"],"related":[],"title":"Drupal Taxonomy Term Glossary: missing authorization lets users browse restricted pages","description":"Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0.","summary":"The Drupal Taxonomy Term Glossary module fails to check authorization on some pages, so a visitor can reach content by forceful browsing. The sources do not say which data is exposed.","severity":"medium","cvss":4.3,"epss":0.00206,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed Taxonomy Term Glossary version in the Drupal project (for example with `composer show drupal/taxonomy_term_glossary` if it is installed via Composer); versions up to `4.6.0` are listed as affected\n- unknown for any other check, the sources do not say","fix":"- Upgrade Taxonomy Term Glossary to a version later than `4.6.0`; the sources do not name the fixed version\n- unknown for other actions, the sources do not say","status":"open","published_at":"2026-10-22T02:17:05+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:37:30+00:00","updated_at":"2026-10-25T04:37:30+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:37:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Taxonomy Term Glossary to a version later than `4.6.0`; the sources do not name the fixed version\n- unknown for other actions, the sources do not say","reach":"internet","title":"Drupal Taxonomy Term Glossary: missing authorization lets users browse restricted pages","impact":"medium","summary":"The Drupal Taxonomy Term Glossary module fails to check authorization on some pages, so a visitor can reach content by forceful browsing. The sources do not say which data is exposed.","category":"package","nicknames":[],"who_cares":["drupal","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Unauthorized visitors can read glossary pages they should not reach","analyst_note":"Confirm the fixed version and which pages lack the access check via the NVD entry for CVE-2026-87954 and the Drupal security advisory.","how_to_check":"- Check the installed Taxonomy Term Glossary version in the Drupal project (for example with `composer show drupal/taxonomy_term_glossary` if it is installed via Composer); versions up to `4.6.0` are listed as affected\n- unknown for any other check, the sources do not say","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal Taxonomy Term Glossary module at version `4.6.0` or earlier are affected. The sources do not say which pages or data are exposed, or whether anonymous visitors can reach them. Sites that do not use this module can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00062,"input_tokens":3335,"output_tokens":574,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-87954':14A,17A '0.0.0':73C '4.6.0':75C 'affect':67C 'allow':62C 'author':6A,32B,55C 'brows':9A,44B,64C 'check':31B 'content':41B 'cve':12A,15A 'data':51B 'drupal':1A,18B,24B,58C 'expos':53B 'fail':29B 'forc':43B,63C 'glossari':4A,27B,61C,70C 'host':22B 'issu':66C 'let':7A 'miss':5A,54C 'modul':28B 'packag':19B 'page':11A,35B 'reach':40B 'restrict':10A 'say':49B 'self':21B 'self-host':20B 'sourc':46B 'taxonomi':2A,25B,59C,68C 'term':3A,26B,60C,69C 'user':8A 'version':71C 'visitor':38B 'vulner':56C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal Taxonomy Term Glossary module at version `4.6.0` or earlier are affected. The sources do not say which pages or data are exposed, or whether anonymous visitors can reach them. Sites that do not use this module can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87954","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87954","severity":null,"published_at":"2026-10-22T02:17:05+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-87954","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87954","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}