SA-CONTRIB-2026-152: Critical severity drupal/term_glossary vulnerability
Published Sep 9, 2026
·Updated
This module adds automatic highlighting of taxonomy terms in content. The module doesn't sufficiently check access on taxonomy terms. As a result, anonymous users can view any of the site's taxonomy terms at the module's JSON endpoint, including taxonomy terms that are unpublished or otherwise restricted.
Credit
Hemant Gupta (guptahemant), Marcus Johansson (marcus_johansson), Serhii Checheniev (serhii-che)
Affected Software
1 affected componentFixes available
drupal/term_glossary<4.6.0
4.6.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/term_glossaryto a version that resolves this vulnerability.Fixed in 4.6.0
Event History
Sep 9, 2026
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Who can access the exposed taxonomy terms?
Anonymous users can view taxonomy terms through the module's JSON endpoint, including terms that are unpublished or otherwise restricted.
2
What access does an attacker need to exploit this issue?
No authentication is required; the issue is exposed to anonymous users at the module's JSON endpoint.