CVE-2025-12082: CivicTheme Design System - Moderately critical - Information disclosure - SA-CONTRIB-2025-112
Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing. This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.
Other sources
Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/civicthemeto a version that resolves this vulnerability.Fixed in 1.12.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12082?
CVE-2025-12082 is considered a medium severity vulnerability due to its ability to allow unauthorized access through forceful browsing.
How do I fix CVE-2025-12082?
To fix CVE-2025-12082, update the Drupal CivicTheme Design System to version 1.12.0 or later.
What is the potential impact of CVE-2025-12082?
The potential impact of CVE-2025-12082 includes unauthorized access to restricted content and data within the application.
Which versions of Drupal CivicTheme Design System are affected by CVE-2025-12082?
CVE-2025-12082 affects all versions of Drupal CivicTheme Design System prior to 1.12.0.
Is there a workaround for CVE-2025-12082 if I cannot update immediately?
There are no known workarounds for CVE-2025-12082; updating to a fixed version is the recommended action.