An improper check for unusual or exceptional conditions allows forceful browsing. The issue occurs when the module is in Permission mode and a node referencing a deleted taxonomy term is accessed via the JSON:API. This requires a specific module configuration and the presence of references to a deleted term to be exploited.