CVE-2025-31686: Drupal Open Social Missing Authorization vulnerability
Drupal Open Social Missing Authorization vulnerability
Other sources
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing. This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
— GitHub
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/goalgorilla/open_socialto a version that resolves this vulnerability.Fixed in 12.4.10 - Upgrade
Upgrade
composer/goalgorilla/open_socialto a version that resolves this vulnerability.Fixed in 12.3.11
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31686?
CVE-2025-31686 is considered a critical vulnerability due to its potential for unauthorized access and forceful browsing.
How do I fix CVE-2025-31686?
To fix CVE-2025-31686, upgrade your Drupal Open Social instance to versions 12.4.10 or 12.3.11 and above.
What systems are affected by CVE-2025-31686?
CVE-2025-31686 affects Drupal Open Social versions prior to 12.3.11 and versions between 12.4.0 and 12.4.10.
What are the potential consequences of CVE-2025-31686?
The potential consequences of CVE-2025-31686 include unauthorized access to user accounts and sensitive information through forceful browsing.
Who is responsible for addressing CVE-2025-31686?
Website administrators and developers using affected versions of Drupal Open Social are responsible for addressing CVE-2025-31686 by applying the necessary updates.