3.7
LowCVSS 3.1 · from CISA
CVE-2026-107311
Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214
Permissions by Term · CWE-754 · CWE-754AffectedPermissions by Term
FixUpdate to 3.1.41 or newer
PublishedOct 30, 03:10 · drupal
Scored3.7 · CISA
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
Description
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.
From drupal
Affected and fixed versions
ProductAffectedFixed inPermissions by Term0.0.0 – before 3.1.413.1.41
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known