| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/permissions_by_term | < 3.1.41 | 3.1.41 |
This module enables you to restrict view access to single nodes via taxonomy terms.
The module doesn't sufficiently check access rights when in "Permission mode" and a node referencing a deleted taxonomy term is accessed via JSON:API.
This vulnerability is mitigated by the fact that it requires a specific module configuration, references to a deleted term, and access via JSON:API to be present.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free