DRUPAL-CONTRIB-2019-068
This module enables you to control access to content based on taxonomy terms. The module doesn't sufficiently check if a given entity should be access controlled, defaulting to allowing access even to unpublished nodes.
The vulnerability is mitigated by the fact that the submodule Permissions by Entity must also be enabled.
What each source reports
OSV No score
This module enables you to control access to content based on taxonomy terms. The module doesn't sufficiently check if a given entity should be access controlled, defaulting to allowing access even to unpublished nodes.
The vulnerability is mitigated by the fact that the submodule Permissions by Entity must also be enabled.
- Record
DRUPAL-CONTRIB-2019-068- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/permissions_by_termPackagist:https://packages.drupal.org/8 |
before 2.11.0 | 2.11.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2019-068 is a vulnerability with no CVSS score yet in drupal/permissions_by_term, published September 25, 2019. No source lists public exploit code. Fixed in drupal/permissions_by_term 2.11.0.