DRUPAL-CONTRIB-2019-093

This module extends access handling of Drupal Core's Taxonomy module.

The module doesn't sufficiently check,

• if a given entity should be access controlled, defaulting to allowing access even to unpublished Taxonomy Terms.
• if certain administrative routes should be access controlled, defaulting to allowing access even to users without permission to access these administrative routes.

The vulnerability is mitigated by the facts, that

• the user interface to change the status of Taxonomy Terms has been released in Drupal Core 8.8 and a custom or contributed module is required in earlier versions of Drupal Core to mark Taxonomy Terms as unpublished.
• all entity operations (except the view operation) available on affected administrative routes still require appropriate permissions.
• an attacker must have a role with permission to either access content or view a Taxonomy Term in a vocabulary.