CVE-2025-31685

Description

Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.

Reserved 2025-03-31 | Published 2025-03-31 | Updated 2025-04-29 | Assigner drupal

Problem types

CWE-862 Missing Authorization

Product status

Default status
unaffected

0.0.0 before 12.3.11
affected

12.4.0 before 12.4.10
affected

Credits

Robert Ragas (robertragas) finder

zanvidmar finder

Denis Kolmerschlag (uber_denis) remediation developer

zanvidmar remediation developer

Greg Knaddison (greggles) coordinator

References

www.drupal.org/sa-contrib-2025-014

cve.org (CVE-2025-31685)

nvd.nist.gov (CVE-2025-31685)

Download JSON