The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpubl…

published 2014-01-24 12 y ago modified 2026-06-17 4 mo ago also EUVD-2014-1552

cvss: 4.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits: 0; none known

The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-1476 updated 2025-11-21 cvss 4.6

drupal: multiple vulnerabilities corrected in 6.30 and 7.26 (SA-CORE-2014-001)

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.12% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	4.0	AV:N/AC:L/Au:S/C:P/I:N/A:N

Classification

Weakness

CWE-264 Permissions, Privileges, and Access Controls

References

debian.org /security/2014/dsa-2847
vendor-advisory
mandriva.com /security/advisories?name=MDVSA-2014:031
vendor-advisory
secunia.com /advisories/56260
third-party-advisory, vendor-advisory
securityfocus.com /bid/64973
vdb-entry
drupal.org /SA-CORE-2014-001

Sources

CVE List CVE-2014-1476
NVD CVE-2014-1476

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary