CVE-2026-107311 - Vulnerability Details - OpenCVE

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Drupal	Permissions By Term

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2026-214

History

Fri, 30 Oct 2026 23:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal permissions By Term
Vendors & Products		Drupal Drupal permissions By Term

Fri, 30 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 30 Oct 2026 03:30:00 +0000

Type	Values Removed	Values Added
Description		Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.
Title		Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214
Weaknesses		CWE-754
References		https://www.drupal.org/sa-contrib-2026-214

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2026-10-30T03:10:00.554Z

Updated: 2026-10-30T20:38:03.847Z

Reserved: 2026-10-07T16:30:25.712Z

Link: CVE-2026-107311

Vulnrichment

Updated: 2026-10-30T20:37:54.275Z

NVD

Status : Awaiting Analysis

Published: 2026-10-30T04:17:58.963

Modified: 2026-10-30T21:16:50.463

Link: CVE-2026-107311

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-107311", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-10-07T16:30:25.712Z", "datePublished": "2026-10-30T03:10:00.554Z", "dateUpdated": "2026-10-30T20:38:03.847Z"}, "containers": {"cna": {"title": "Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214", "datePublic": "2026-10-07T16:39:13.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-214"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-754", "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-87", "descriptions": [{"lang": "en", "value": "CAPEC-87 Forceful Browsing"}]}], "affected": [{"collectionURL": "https://www.drupal.org/project/permissions_by_term", "product": "Permissions by Term", "vendor": "Drupal", "repo": "https://git.drupalcode.org/project/permissions_by_term", "versions": [{"lessThan": "3.1.41", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41."}], "credits": [{"lang": "en", "type": "finder", "value": "ayrmax"}, {"lang": "en", "type": "remediation developer", "value": "Peter Majmesku (jepster_)"}, {"lang": "en", "type": "remediation developer", "value": "Marc-Oliver Teschke (marcoliver)"}, {"lang": "en", "type": "coordinator", "value": "Swan Kalata (akalata)"}, {"lang": "en", "type": "coordinator", "value": "Damien McKenna (damienmckenna)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}, {"lang": "en", "type": "coordinator", "value": "Pierre Rudloff (prudloff)"}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-10-30T03:10:00.554Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T20:37:59.511561Z", "id": "CVE-2026-107311", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T20:38:03.847Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-107311", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T20:37:59.511561Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T20:37:54.275Z"}}], "cna": {"title": "Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214", "credits": [{"lang": "en", "type": "finder", "value": "ayrmax"}, {"lang": "en", "type": "remediation developer", "value": "Peter Majmesku (jepster_)"}, {"lang": "en", "type": "remediation developer", "value": "Marc-Oliver Teschke (marcoliver)"}, {"lang": "en", "type": "coordinator", "value": "Swan Kalata (akalata)"}, {"lang": "en", "type": "coordinator", "value": "Damien McKenna (damienmckenna)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}, {"lang": "en", "type": "coordinator", "value": "Pierre Rudloff (prudloff)"}], "impacts": [{"capecId": "CAPEC-87", "descriptions": [{"lang": "en", "value": "CAPEC-87 Forceful Browsing"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/permissions_by_term", "vendor": "Drupal", "product": "Permissions by Term", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "3.1.41", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/permissions_by_term"}], "datePublic": "2026-10-07T16:39:13.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-214"}], "descriptions": [{"lang": "en", "value": "Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-754", "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-10-30T03:10:00.554Z"}}}, "cveMetadata": {"cveId": "CVE-2026-107311", "state": "PUBLISHED", "dateUpdated": "2026-10-30T20:38:03.847Z", "dateReserved": "2026-10-07T16:30:25.712Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2026-10-30T03:10:00.554Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}