Every CVE Search/ Get API key

CVE-2025-31673

Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

4.6 MediumFix available

Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.32%Up 0.3 points since Apr 1, 2025
90%50%10%1%

What each source reports

CVE List Score used 4.6

Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

Record
CVE-2025-31673
CVSS 3.1
4.6 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2025-9043 4.6

Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

Record
EUVD-2025-9043
CVSS 3.1
4.6 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-wpp8-fjgf-pwc7 5.3

Drupal Core Vulnerable to Forceful Browsing

Incorrect Authorization vulnerability in Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

Record
GHSA-wpp8-fjgf-pwc7
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
4.6 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
GitHub AdvisoriesGHSA-6ccv-8fgf-cjpw No score

Drupal core Denial of Service vulnerability

The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).

Sites that do not use the Comment module are not affected.

Record
GHSA-6ccv-8fgf-cjpw
Updated
2026-11-02
NVD 4.6

Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

Record
CVE-2025-31673
CVSS 3.1
4.6 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
OSV 4.6

Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

Record
CVE-2025-31673
CVSS 3.1
4.6 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-wpp8-fjgf-pwc7 5.3

Drupal Core Vulnerable to Forceful Browsing

Incorrect Authorization vulnerability in Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

Record
GHSA-wpp8-fjgf-pwc7
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
4.6 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
OSVBIT-drupal-2025-31673 No score

Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

Record
BIT-drupal-2025-31673
Updated
2026-11-02
OSVCLSA-2026-1776214337 No score

TuxCare security update for drupal/core (11 CVEs)

TuxCare rebuilt drupal/core to address 11 CVEs. Fixed in 9.5.11-p1+tuxcare.

Record
CLSA-2026-1776214337
Updated
2026-11-02
OSVCLSA-2026-1784682869 No score

TuxCare security update for drupal/core (21 CVEs)

TuxCare rebuilt drupal/core to address 21 CVEs. Fixed in 8.9.20-p1+tuxcare.

Record
CLSA-2026-1784682869
Updated
2026-11-02
OSVDRUPAL-CORE-2025-002 No score

Bulk operations allow authorized users to modify several nodes at once from the Content page (/admin/content). A site builder can also add bulk operations to other pages using Views.

A bug in the core Actions system allows some users to modify some fields using bulk actions that they do not have permission to modify on individual nodes.

This vulnerability is mitigated by the fact that an attacker must have permission to access /admin/content or other, custom views and to edit nodes.

In particular, the bulk operations

  • Make content sticky
  • Make content unsticky
  • Promote content to front page
  • Publish content
  • Remove content from front page
  • Unpublish content

now require the "Administer content" permission.

Record
DRUPAL-CORE-2025-002
Updated
2026-11-02
OSVGHSA-6ccv-8fgf-cjpw No score

Drupal core Denial of Service vulnerability

The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).

Sites that do not use the Comment module are not affected.

Record
GHSA-6ccv-8fgf-cjpw
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
drupal/core
Packagist
 8.0.0 up to 10.1.8
10.1.8
drupal/core
Packagist
 10.2.0 up to 10.2.2
10.2.2
drupal/core
Packagist
 8.0.0 up to 10.3.13
10.3.13
drupal/core
Packagist
 10.4.0 up to 10.4.3
10.4.3
drupal/core
Packagist
 11.0.0 up to 11.0.12
11.0.12
drupal/core
Packagist
 11.1.0 up to 11.1.3
11.1.3
drupal
Bitnami
 8.0.0 up to 10.4.3, 11.0.0 up to 11.1.3
10.4.311.1.3
drupal/core
TuxCare:Packagist
From an advisory covering 10 CVEs
 9.5.11 up to 9.5.11-p1+tuxcare
9.5.11-p1+tuxcare
drupal/core
TuxCare:Packagist
From an advisory covering 20 CVEs
 8.9.20 up to 8.9.20-p1+tuxcare
8.9.20-p1+tuxcare
drupal/core
Packagist
 8.0.0 up to 10.3.13, 10.4.0 up to 10.4.3, 11.0.0 up to 11.0.12, 11.1.0 up to 11.1.3, plus listed versions
10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4
Show 45 moreShow less
10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.1.810.2.010.2.0-alpha110.2.0-beta110.2.0-rc110.2.110.2.1010.2.1110.2.1210.2.210.2.310.2.410.2.510.2.610.2.7
10.3.1310.4.311.0.1211.1.3
Show 6 moreShow less
Affected packages
PackageAffectedFixed
drupal/core
Packagist
 8.0.0 up to 10.1.8, plus listed versions
10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4
Show 45 moreShow less
10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.78.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.4
10.1.8
drupal/core
Packagist
 10.2.0 up to 10.2.2, plus listed versions
10.2.1
10.2.2
drupal/core
Packagist
 8.0.0 up to 10.3.13, plus listed versions
10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4
Show 45 moreShow less
10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.1.810.2.010.2.0-alpha110.2.0-beta110.2.0-rc110.2.110.2.1010.2.1110.2.1210.2.210.2.310.2.410.2.510.2.610.2.7
10.3.13
drupal/core
Packagist
 10.4.0 up to 10.4.3, plus listed versions
10.4.110.4.2
10.4.3
drupal/core
Packagist
 11.0.0 up to 11.0.12, plus listed versions
11.0.111.0.1011.0.1111.0.211.0.3
Show 6 moreShow less
11.0.411.0.511.0.611.0.711.0.811.0.9
11.0.12
drupal/core
Packagist
 11.1.0 up to 11.1.3, plus listed versions
11.1.111.1.2
11.1.3

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-31673 is a medium vulnerability (CVSS 4.6) in Drupal, published February 12, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 24th percentile. Fixed in drupal/core 10.1.8.

References

Show 6 moreShow less
This page doesn't list everything

Left out here: 925 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open