CVE-2025-31685: Drupal Open Social Missing Authorization vulnerability
Drupal Open Social Missing Authorization vulnerability
Other sources
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing. This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
— GitHub
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/goalgorilla/open_socialto a version that resolves this vulnerability.Fixed in 12.4.10 - Upgrade
Upgrade
composer/goalgorilla/open_socialto a version that resolves this vulnerability.Fixed in 12.3.11
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31685?
CVE-2025-31685 is classified as a moderate severity vulnerability due to the risk of forceful browsing.
How do I fix CVE-2025-31685?
To fix CVE-2025-31685, you should upgrade your Drupal Open Social installation to version 12.4.10 or later.
Which versions are affected by CVE-2025-31685?
CVE-2025-31685 affects Open Social versions from 0.0.0 to before 12.3.11 and from 12.4.0 to before 12.4.10.
What is missing authorization in CVE-2025-31685?
The missing authorization in CVE-2025-31685 allows unauthorized users to access resources they shouldn't have permission to view.
Is there a patch available for CVE-2025-31685?
Yes, a patch is included in the updates for Drupal Open Social version 12.4.10 and later.