The vulnerability is a missing authorization flaw that allows forceful browsing of taxonomy term glossary data. Unprivileged users can request any term record and retrieve its information, bypassing the intended access controls. Because the flaw does not require authentication, an attacker who can send HTTP requests to the vulnerable site can read taxonomy term glossary data, compromising confidentiality. It is inferred that an attacker could send crafted HTTP requests to the taxonomy glossary endpoints to forcefully retrieve data.

The issue affects the Drupal Taxonomy Term Glossary module from the initial release through version 4.6.0. Systems running any of those versions should verify the module version and evaluate whether the taxonomy term glossary feature is exposed to users who should not have access.

The vulnerability has an EPSS score of less than 1% and is not listed in the KEV catalog. The CVSS score is 4.3, indicating a moderate severity. An attacker who can send HTTP requests to the vulnerable site can forcefully retrieve taxonomy glossary data by crafting the appropriate URL, requiring no special credentials. Based on the description, the likely attack vector is sending crafted HTTP requests to the taxonomy glossary endpoints. The absence of publicly available mitigation emphasizes the importance of applying any available fix or disabling the module.