DRUPAL-CONTRIB-2023-001
This module enables users to create 'private' vocabularies.
The module doesn't enforce permissions appropriately for the taxonomy overview page and overview form.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer own taxonomy" or "View private taxonomies"
What each source reports
OSV No score
This module enables users to create 'private' vocabularies.
The module doesn't enforce permissions appropriately for the taxonomy overview page and overview form.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer own taxonomy" or "View private taxonomies"
- Record
DRUPAL-CONTRIB-2023-001- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/private_taxonomyPackagist:https://packages.drupal.org/8 |
before 2.6.0 | 2.6.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2023-001 is a vulnerability with no CVSS score yet in drupal/private_taxonomy, published January 11, 2023. No source lists public exploit code. Fixed in drupal/private_taxonomy 2.6.0.