CVE-2025-31673: Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002
Incorrect Authorization vulnerability in Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
Other sources
Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31673?
CVE-2025-31673 is categorized as a critical severity vulnerability affecting multiple versions of Drupal core.
How do I fix CVE-2025-31673?
To resolve CVE-2025-31673, upgrade your Drupal core to version 10.4.3, 11.0.12, or 11.1.3, or later versions.
What versions of Drupal are affected by CVE-2025-31673?
CVE-2025-31673 affects Drupal core versions from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, and from 11.0.0 before 11.0.12 and 11.1.0 before 11.1.3.
What type of vulnerability is CVE-2025-31673?
CVE-2025-31673 is an incorrect authorization vulnerability that allows for forceful browsing.
Is authentication required to exploit CVE-2025-31673?
No, CVE-2025-31673 can be exploited without any authentication, making it particularly severe.