PatchClock

PHP security digest · 7 Oct 2026

This module enables you to show a breadcrumb trail for taxonomy term hierarchies. The module doesn't sufficiently check for view access of parent terms before...

Unrated CVE-2026-107309

Package
drupal/easy_breadcrumb
Fixed in
2.0.11
Published
Wed 7 Oct 2026, 17:37 LisbonUpdated Mon 26 Oct 2026, 04:26 Lisbon

In plain words

The module can show a parent taxonomy term in a breadcrumb without sufficiently checking whether the visitor has permission to view it. This can expose an unpublished parent term when “Add parent hierarchy” is enabled and a term has an unpublished term in its parent hierarchy.

Am I affected?

Look for drupal/easy_breadcrumb and its installed version in composer.lock. The advisory lists 2.0.11 as fixed but gives no affected version range. Check whether “Add parent hierarchy” (term_hierarchy) is enabled and whether any taxonomy term has an unpublished term in its parent hierarchy. Both conditions are required for this vulnerability.

What to do

Check which version you have, then update to a fixed release for your branch (2.0.11):

composer show drupal/easy_breadcrumb | grep versions
composer update drupal/easy_breadcrumb

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

Keep “Add parent hierarchy” (term_hierarchy) disabled, or ensure no term has an unpublished term in its parent hierarchy.

The advisory's description

This module enables you to show a breadcrumb trail for taxonomy term hierarchies.

The module doesn't sufficiently check for view access of parent terms before rendering the crumb segment.

This vulnerability is mitigated by the fact that the setting "Add parent hierarchy" (term_hierarchy) must be enabled, and at least one term has a term in the parent hierarchy that is unpublished.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.