CVE-2026-87954: Drupal Term Glossary Module Access Control Vulnerability
Summary
CVE-2026-87954: This module adds automatic highlighting of taxonomy terms in content. Affects drupal/term_glossary versions < 4.6.0. Fixed in 4.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Drupal Term Glossary module enhances content by automatically highlighting taxonomy terms. It is widely used in Drupal-based websites to improve user experience and content discoverability. However, this module has a critical vulnerability that allows unauthorized access to sensitive taxonomy term information.
Vulnerability Detail
The vulnerability arises from insufficient access checks on taxonomy terms within the Term Glossary module. This flaw permits anonymous users to access the module's JSON endpoint, exposing all taxonomy terms, including those that are unpublished or restricted. This can lead to unauthorized information disclosure, potentially compromising the site's content security and integrity.
How To Fix
Minimum fixed version
4.6.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the taxonomy terms by modifying the permissions for anonymous users in your Drupal site's user permissions settings. Ensure that anonymous users do not have access to view taxonomy terms.
Conclusion
The CVE-2026-87954 vulnerability in the Drupal Term Glossary module poses a significant risk by allowing unauthorized access to taxonomy terms. It is crucial for users of this module to update to version 4.6.0 or later to mitigate this risk. Additionally, implementing temporary workarounds can help protect sensitive information until the update is applied.
See every vulnerability recorded for drupal/term_glossary →
FAQ
CVE-2026-87954 is a vulnerability in the Drupal Term Glossary module that allows unauthorized access to taxonomy terms by anonymous users.
If you are using a version of the Term Glossary module prior to 4.6.0, your site is vulnerable. You can check your version in the Drupal admin interface or by inspecting your composer.lock file.
Failure to address this vulnerability may lead to unauthorized users accessing sensitive taxonomy information, which could compromise your site's content security and user privacy.
Yes, tools like Vulert can monitor your application for open-source vulnerabilities in real-time using just a manifest file like package-lock.json. You can check your application against known vulnerabilities without needing to install any software.
You can find more details about CVE-2026-87954 and its implications on the official Drupal security advisories page or by visiting the GitHub repository for the Term Glossary module.
