SA-CONTRIB-2026-212: Critical severity drupal/easy_breadcrumb vulnerability

Q: Which sites are exposed to this issue?

Sites using the module are exposed only when the “Add parent hierarchy” (term_hierarchy) setting is enabled and at least one taxonomy term has an unpublished term in its parent hierarchy.

Q: How can I check whether my site meets the vulnerable conditions?

Review the module configuration to see whether “Add parent hierarchy” is enabled. Then inspect taxonomy hierarchies for terms whose parent chain includes an unpublished term.

Published Oct 7, 2026

Updated

This module enables you to show a breadcrumb trail for taxonomy term hierarchies. The module doesn't sufficiently check for view access of parent terms before rendering the crumb segment. This vulnerability is mitigated by the fact that the setting "Add parent hierarchy" (termhierarchy) must be enabled, and at least one term has a term in the parent hierarchy that is unpublished.

Credit

Marcus Johansson (marcus_johansson)

Affected Software

1 affected componentFixes available

drupal/easy_breadcrumb<2.0.11

2.0.11

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/easy_breadcrumb to a version that resolves this vulnerability.
Fixed in 2.0.11

Event History

Oct 7, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-107309

Frequently Asked Questions

Which sites are exposed to this issue?

Sites using the module are exposed only when the “Add parent hierarchy” (term_hierarchy) setting is enabled and at least one taxonomy term has an unpublished term in its parent hierarchy.

How can I check whether my site meets the vulnerable conditions?

Review the module configuration to see whether “Add parent hierarchy” is enabled. Then inspect taxonomy hierarchies for terms whose parent chain includes an unpublished term.

SA-CONTRIB-2026-212: Critical severity drupal/easy_breadcrumb vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which sites are exposed to this issue?

How can I check whether my site meets the vulnerable conditions?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to this issue?

How can I check whether my site meets the vulnerable conditions?