An improper check for unusual or exceptional conditions in the Drupal Permissions by Term module allows attackers to forcefully browse to arbitrary content that should be restricted. This vulnerability can expose sensitive site data to anyone who can construct URLs, resulting in information disclosure. The flaw is grounded in a missing authorization gate, which is a common weakness that enables unauthorized access.

Drupal sites that have the Permissions by Term module installed, any version ranging from 0.0.0 up to and including 3.1.41. The impact applies regardless of the overall Drupal core version, as the vulnerability resides wholly in the module code.

The risk is moderate; there is no EPSS score available and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation to date. An attacker requires the ability to guess or discover valid URLs, so the attack vector is likely remote web requests against exposed endpoints. While the severity is not extreme, any compromised content visibility can undermine privacy and regulatory compliance, warranting prompt action.