CVE-2025-31685
Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
- Record
CVE-2025-31685- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2025-9038
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
- Record
EUVD-2025-9038- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gf72-h4cp-wcm4
Drupal Open Social Missing Authorization vulnerability
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing. This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
- Record
GHSA-gf72-h4cp-wcm4- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
- Record
CVE-2025-31685- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
- Record
CVE-2025-31685- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVGHSA-gf72-h4cp-wcm4
Drupal Open Social Missing Authorization vulnerability
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing. This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
- Record
GHSA-gf72-h4cp-wcm4- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVDRUPAL-CONTRIB-2025-014 No score
Open Social is a Drupal distribution for online communities, which ships with a default (optional) module social_language to make your platform multilingual.
Some site administration configuration does not correctly check access when trying to translate allowing unauthorised people to translate these parts.
The issue is mitigated by the fact that social_language needs to be enabled with more than 1 language.
- Record
DRUPAL-CONTRIB-2025-014- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
goalgorilla/open_socialPackagist |
before 12.3.11 | 12.3.11 |
goalgorilla/open_socialPackagist |
12.4.0 up to 12.4.10 | 12.4.10 |
goalgorilla/open_socialPackagist |
before 12.3.11, plus listed versions 1.0.01.0.0-alpha61.0.0-alpha71.0.0-beta11.0.0-beta10 Show 45 moreShow less1.0.0-beta111.0.0-beta121.0.0-beta131.0.0-beta141.0.0-beta21.0.0-beta31.0.0-beta41.0.0-beta51.0.0-beta61.0.0-beta71.0.0-beta81.0.0-beta91.0.0-rc11.0.0-rc21.0.0-rc31.0.0-rc41.0.0-rc51.0.0-rc61.0.0-rc71.0.0-rc81.1.01.10.01.11.01.12.01.13.01.14.01.15.01.16.01.17.01.18.01.19.01.2.01.3.01.4.01.5.01.6.01.7.01.8.01.9.010.0.010.0.110.0.1010.0.1110.0.1210.0.13 |
12.3.11 |
goalgorilla/open_socialPackagist |
12.4.0 up to 12.4.10, plus listed versions 12.4.112.4.212.4.312.4.412.4.5 Show 4 moreShow less12.4.612.4.712.4.812.4.9 |
12.4.10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-31685 is a critical vulnerability (CVSS 9.1) in Drupal Open Social, published February 12, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in goalgorilla/open_social 12.3.11.
References
drupal.org/sa-contrib-2025-014
nvd.nist.gov/vuln/detail/CVE-2025-31685
github.com/goalgorilla/open_social/commit/52c531e156fb8653e47ab99df432c4fb9651f36e
git.drupalcode.org/project/social
Left out here: 389 versions. The JSON record has them.