PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-87954 Drupal CVE debrief

A Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions from 0.0.0 to 4.6.0. The vulnerability could potentially allow unauthorized access and data exposure. Users and administrators of affected versions should verify exposure, apply patches, and monitor for potential forceful browsing attempts. The CVE record and source item provide details on the vulnerability, but vendor remediation and affected scope require verification.

Vendor
Drupal
Product
Taxonomy Term Glossary
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-22
Advisory published
2026-10-22
Advisory updated
2026-10-22

Who should care

Drupal users and administrators, particularly those using Taxonomy Term Glossary versions prior to 4.6.0, should assess exposure and apply patches as necessary.

Why it matters

Defenders should care about CVE-2026-87954 because it affects Drupal Taxonomy Term Glossary, potentially allowing unauthorized access and data exposure. Users and administrators of affected versions should verify exposure, apply patches, and monitor for potential forceful browsing attempts.

  • Potential unauthorized access to taxonomy terms
  • Forceful browsing attempts may lead to data exposure
  • Verification of inventory and patching is necessary
  • Remediation priority is high for affected versions

Technical summary

The Taxonomy Term Glossary module for Drupal has a Missing Authorization vulnerability, allowing for forceful browsing. The issue affects versions from 0.0.0 to 4.6.0. This vulnerability could potentially allow unauthorized access and data exposure. Users and administrators of affected versions should verify exposure and apply patches as necessary. The vulnerability allows for forceful browsing, potentially leading to data exposure.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Taxonomy Term Glossary versions prior to 4.6.0.

Recommended defensive actions

  • Verify Taxonomy Term Glossary version and apply patches if necessary
  • Review and update inventory of affected systems
  • Monitor for potential forceful browsing attempts

Evidence notes

The CVE record and source item provide details on the vulnerability, but vendor remediation and affected scope require verification. Affected Drupal Taxonomy Term Glossary versions prior to 4.6.0 should be verified for exposure. Defenders should review the official advisory or CVE record to validate affected scope, severity, and vendor guidance. The vulnerability allows for forceful browsing, potentially leading to data exposure. Compensating controls for exposed systems should be be

Sources and references

Verified primary and authoritative sources

  • CVE-2026-87954 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-87954

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-87954 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-87954

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.