CVE-2026-107311 Drupal CVE debrief

Who should care

Drupal administrators and developers using the Permissions by Term module should assess exposure and verify module configuration to prevent unauthorized access to nodes via JSON:API. They should also monitor JSON:API usage and node access requests to detect potential security breaches.

Why it matters

Defenders should prioritize verifying module configuration, ensuring access controls are in place, and monitoring JSON:API usage to prevent unauthorized access to nodes.

• Verify access controls for JSON:API node access requests
• Monitor node access requests for potential unauthorized access
• Update module configuration to prevent exploitation

Technical summary

The Permissions by Term module for Drupal does not sufficiently check access rights when in 'Permission mode' and a node referencing a deleted taxonomy term is accessed via JSON:API. This vulnerability requires specific configuration and access via JSON:API to be exploited. Defenders should prioritize verifying module configuration, ensuring access controls are in place, and monitoring JSON:API usage to prevent unauthorized access to nodes. The issue arises from insufficient access rights checks in the module, potentially allowing attackers to access sensitive information.

Defensive priority

Defenders should prioritize verifying module configuration, ensuring access controls are in place, and monitoring JSON:API usage.

Recommended defensive actions

• Verify module configuration and ensure access controls are in place
• Monitor JSON:API usage and node access requests
• Update to version 3.1.41 or later if vulnerable
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in the Permissions by Term module for Drupal, specifically when accessing nodes via JSON:API and referencing deleted taxonomy terms. The issue arises from insufficient access rights checks in 'Permission mode'. Defenders should verify module configuration, ensure access controls are in place, and monitor JSON:API usage to prevent unauthorized access to nodes. The vulnerability requires specific module configuration, references to a deleted term, and access via JSON:API to be present.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.