PatchClock

PHP security digest · 7 Oct 2026

This module enables you to restrict view access to single nodes via taxonomy terms. The module doesn't sufficiently check access rights when in "Permission mod...

Unrated CVE-2026-107311

Package
drupal/permissions_by_term
Fixed in
3.1.41
Published
Wed 7 Oct 2026, 17:39 LisbonUpdated Mon 26 Oct 2026, 04:27 Lisbon

In plain words

The module can fail to enforce view access restrictions when a node is accessed through JSON:API. This happens when the module is in "Permission mode" and the node references a deleted taxonomy term, potentially allowing someone to view content they should not have access to.

Am I affected?

Look for drupal/permissions_by_term and its version in composer.lock. The advisory lists 3.1.41 as fixed but gives no affected version range. Check whether the module is in "Permission mode", whether nodes reference deleted taxonomy terms, and whether those nodes are accessible through JSON:API. All three conditions are required.

What to do

Check which version you have, then update to a fixed release for your branch (3.1.41):

composer show drupal/permissions_by_term | grep versions
composer update drupal/permissions_by_term

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The vulnerability is mitigated by requiring a specific module configuration ("Permission mode"), references to a deleted taxonomy term, and access via JSON:API to be present.

The advisory's description

This module enables you to restrict view access to single nodes via taxonomy terms.

The module doesn't sufficiently check access rights when in "Permission mode" and a node referencing a deleted taxonomy term is accessed via JSON:API.

This vulnerability is mitigated by the fact that it requires a specific module configuration, references to a deleted term, and access via JSON:API to be present.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.