{"id":"CVE-2014-1476","aliases":["DSA-2847-1","EUVD-2014-1552","GHSA-c6j8-r888-r854","MGASA-2014-0031","UBUNTU-CVE-2014-1476"],"status":"published","title":"The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal,...","description":"The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01118,"percentile":0.66324,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-264"],"published":"2014-01-20T00:00:00Z","modified":"2026-06-17T00:04:56Z","affected":[{"source":"osv","ecosystem":"Debian:7","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14-2+deb7u2"}]}],"versions":["7.14-2","7.14-2+deb7u1","7.14-2+deb7u1~bpo60+1","7.14-2+deb7u2~bpo60+1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.26-1.mga3"}]}],"bundled":2}],"products":[{"vendor":"drupal","product":"drupal"}],"references":[{"url":"http://www.debian.org/security/2014/dsa-2847","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/64973","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://drupal.org/SA-CORE-2014-001","tags":["x_refsource_CONFIRM","x_transferred","web","report"]},{"url":"http://secunia.com/advisories/56260","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:031","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1476"},{"url":"https://github.com/advisories/GHSA-c6j8-r888-r854"},{"url":"https://advisories.mageia.org/MGASA-2014-0031.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-1476","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2014/01/16","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-1476","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-1476","description":"The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page.","status":"published","published":"2014-01-24T18:00:00Z","modified":"2024-08-06T09:42:35.659Z","updated_at":"2026-11-02T14:33:45.938615Z"}],"euvd":[{"id":"EUVD-2014-1552","description":"The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page.","status":"published","published":"2014-01-24T18:00:00Z","modified":"2024-08-06T09:42:35Z","updated_at":"2026-11-03T01:57:18.349202Z"}],"ghsa":[{"id":"GHSA-c6j8-r888-r854","title":"The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal,...","description":"The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page.","status":"published","published":"2022-05-17T04:52:25Z","modified":"2023-01-28T05:02:42Z","updated_at":"2026-11-02T14:43:49.735086Z"}],"nvd":[{"id":"CVE-2014-1476","description":"The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page.","status":"published","published":"2014-01-24T18:55:05.15Z","modified":"2026-06-17T00:04:56.587Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:53.330367Z"}],"osv":[{"id":"DSA-2847-1","title":"drupal7 - several","status":"published","published":"2014-01-20T00:00:00Z","modified":"2026-03-09T01:18:26.055372Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0031","title":"Updated drupal package fixes security vulnerabilities","description":"Christian Mainka and Vladislav Mladenov reported a vulnerability in the\nOpenID module that allows a malicious user to log in as other users on the\nsite, including administrators, and hijack their accounts (CVE-2014-1475).\n\nMatt Vance and Damien Tournoud reported an access bypass vulnerability in\nthe taxonomy module. Under certain circumstances, unpublished content can\nappear on listing pages provided by the taxonomy module and will be\nvisible to users who should not have permission to see it (CVE-2014-1476).\n","status":"published","published":"2014-01-31T16:43:58Z","modified":"2026-04-16T06:26:13.663020773Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2014-1476","description":"The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page.","status":"withdrawn","published":"2014-01-24T18:55:00Z","modified":"2025-07-16T07:31:44.598577Z","updated_at":"2026-11-02T15:54:07.855521Z"}]}}