Every CVE Search/ Get API key

CVE-2025-31689

General Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-018

8.1 HighFix available

Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
High

Exploit likelihood

0.21%Up 0.2 points since Apr 1, 2025
90%50%10%1%

What each source reports

CVE List Score used 8.1

General Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-018

Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.

Record
CVE-2025-31689
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Weakness
CWE-352
Updated
2026-11-02
EUVDEUVD-2025-9017 8.1

Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.

Record
EUVD-2025-9017
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-jv6r-mj9p-9xff 5.1

Drupal General Data Protection Regulation Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery. This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.

Record
GHSA-jv6r-mj9p-9xff
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Weakness
CWE-352
Updated
2026-11-02
NVD 8.1

Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.

Record
CVE-2025-31689
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Weakness
CWE-352
Updated
2026-11-02
OSV 8.1

General Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-018

Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.

Record
CVE-2025-31689
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Weakness
CWE-352
Updated
2026-11-02
OSVGHSA-jv6r-mj9p-9xff 5.1

Drupal General Data Protection Regulation Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery. This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.

Record
GHSA-jv6r-mj9p-9xff
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Weakness
CWE-352
Updated
2026-11-02
Show 4 moreShow less
OSVCLSA-2026-1788971869 No score

TuxCare security update for drupal/gdpr (1 CVE)

TuxCare rebuilt drupal/gdpr to address 1 CVE. Fixed in 7.1.0-p1+tuxcare.

Record
CLSA-2026-1788971869
Updated
2026-11-02
OSVCLSA-2026-1788972898 No score

TuxCare security update for drupal/gdpr (1 CVE)

TuxCare rebuilt drupal/gdpr to address 1 CVE. Fixed in 3.1.0-p1+tuxcare.

Record
CLSA-2026-1788972898
Updated
2026-11-02
OSVCLSA-2026-1790249402 No score

TuxCare security update for drupal/gdpr (1 CVE)

TuxCare rebuilt drupal/gdpr to address 1 CVE. Fixed in 3.0.0-p1+tuxcare.

Record
CLSA-2026-1790249402
Updated
2026-11-02
OSVDRUPAL-CONTRIB-2025-018 No score

The GDPR Task submodule enables you to create GDPR tasks.

The module doesn't sufficiently protect against Cross Site Request Forgery (CSRF) attacks by validating user identity and intent when creating tasks.

Record
DRUPAL-CONTRIB-2025-018
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
drupal/gdpr
Packagist
 before 3.0.1
3.0.1
drupal/gdpr
Packagist
 3.1.0 up to 3.1.2
3.1.2
drupal/gdpr
TuxCare:Packagist
 7.1.0 up to 7.1.0-p1+tuxcare
7.1.0-p1+tuxcare
drupal/gdpr
TuxCare:Packagist
 3.1.0 up to 3.1.0-p1+tuxcare
3.1.0-p1+tuxcare
drupal/gdpr
TuxCare:Packagist
 3.0.0 up to 3.0.0-p1+tuxcare
3.0.0-p1+tuxcare
drupal/gdpr
Packagist:https://packages.drupal.org/8
 before 3.0.1, 3.1.0 up to 3.1.2
3.0.13.1.2

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-31689 is a high vulnerability (CVSS 8.1) in Drupal General Data Protection Regulation, published February 26, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in drupal/gdpr 3.0.1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open