CVE-2025-31673: Drupal Core Vulnerable to Forceful Browsing
Drupal Core Vulnerable to Forceful Browsing
Other sources
Incorrect Authorization vulnerability in Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
— GitHub
Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 11.1.3 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 11.0.12 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 10.4.3 - Upgrade
Upgrade
composer/drupal/coreto a version that resolves this vulnerability.Fixed in 10.3.13
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31673?
CVE-2025-31673 is categorized as a critical severity vulnerability affecting multiple versions of Drupal core.
How do I fix CVE-2025-31673?
To resolve CVE-2025-31673, upgrade your Drupal core to version 10.4.3, 11.0.12, or 11.1.3, or later versions.
What versions of Drupal are affected by CVE-2025-31673?
CVE-2025-31673 affects Drupal core versions from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, and from 11.0.0 before 11.0.12 and 11.1.0 before 11.1.3.
What type of vulnerability is CVE-2025-31673?
CVE-2025-31673 is an incorrect authorization vulnerability that allows for forceful browsing.
Is authentication required to exploit CVE-2025-31673?
No, CVE-2025-31673 can be exploited without any authentication, making it particularly severe.