View online: https://www.drupal.org/sa-contrib-2026-214 Project: Permissions by Term [1] Project machine name: permissions_by_term Date: 2026-October-07 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure CVE IDs: CVE-2026-107311 Description: This module enables you to restrict view access to single nodes via taxonomy terms. The module doesn't sufficiently check access rights when in "Permission mode" and a node referencing a deleted taxonomy term is accessed via JSON:API. This vulnerability is mitigated by the fact that it requires a specific module configuration, references to a deleted term, and access via JSON:API to be present. Solution: Install the latest version: * If you use the Permissions by Term module, upgrade to Permissions by Term 3.1.41 [3] Reported By: * ayrmax [4] Fixed By: * Peter Majmesku (jepster_) [5] * Marc-Oliver Teschke (marcoliver) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Damien McKenna (damienmckenna) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Pierre Rudloff (prudloff) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/permissions_by_term [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/permissions_by_term/releases/3.1.41 [4] https://www.drupal.org/u/ayrmax [5] https://www.drupal.org/u/jepster_ [6] https://www.drupal.org/u/marcoliver [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/damienmckenna [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/prudloff [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....