PatchClock

PHP security digest · 9 Sep 2026

This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous us...

Unrated CVE-2026-87954

Package
drupal/term_glossary
Fixed in
4.6.0
Published
Wed 9 Sep 2026, 18:24 LisbonUpdated Sun 25 Oct 2026, 23:25 Lisbon

In plain words

The module does not properly check access to taxonomy terms at its JSON endpoint. Anonymous users can view any of the site's taxonomy terms through that endpoint, including unpublished or otherwise restricted terms.

Am I affected?

Look for drupal/term_glossary and its installed version in composer.lock. The advisory lists 4.6.0 as fixed but does not give an affected version range. Review whether your site has unpublished or otherwise restricted taxonomy terms, as these can be exposed through the module's JSON endpoint.

What to do

Check which version you have, then update to a fixed release for your branch (4.6.0):

composer show drupal/term_glossary | grep versions
composer update drupal/term_glossary

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

This module adds automatic highlighting of taxonomy terms in content.

The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous users can view any of the site's taxonomy terms at the module's JSON endpoint, including taxonomy terms that are unpublished or otherwise restricted.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.