PT-2026-107765

CVE-2026-107311

Published

2026-10-07

Updated

2026-10-30

Description by

CVSS 3.1

3.7

Low

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Permissions by Term versions 0.0.0 through 3.1.41

Description An improper check for unusual or exceptional conditions allows forceful browsing. The issue occurs when the module is in Permission mode and a node referencing a deleted taxonomy term is accessed via the JSON:API. This requires a specific module configuration and the presence of references to a deleted term to be exploited.

Recommendations Update Permissions by Term to a version newer than 3.1.41.

Exploitability

Exploit

Fix

Impacts

Researchers