View online: https://www.drupal.org/sa-contrib-2026-212 Project: Easy Breadcrumb [1] Project machine name: easy_breadcrumb Date: 2026-October-07 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure Affected versions: <2.0.11 CVE IDs: CVE-2026-107309 Description: This module enables you to show a breadcrumb trail for taxonomy term hierarchies. The module doesn't sufficiently check for view access of parent terms before rendering the crumb segment. This vulnerability is mitigated by the fact that the setting "Add parent hierarchy" (term_hierarchy) must be enabled, and at least one term has a term in the parent hierarchy that is unpublished. Solution: Install the latest version: * If you use the Easy Breadcrumb module, upgrade to Easy Breadcrumb 2.0.11 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Brooke Mahoney (loopduplicate) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [8] [1] https://www.drupal.org/project/easy_breadcrumb [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/easy_breadcrumb/releases/2.0.11 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/loopduplicate [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/poker10 [8] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....