CVE-2025-8361
Config Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-093
Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing.
This issue affects Config Pages: from 0.0.0 before 2.18.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Config Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-093
Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing.
This issue affects Config Pages: from 0.0.0 before 2.18.0.
- Record
CVE-2025-8361- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2025-25036
Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing.
This issue affects Config Pages: from 0.0.0 before 2.18.0.
- Record
EUVD-2025-25036- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w63x-4vj8-p867
Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing.This issue...
Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing.This issue affects Config Pages: from 0.0.0 before 2.18.0.
- Record
GHSA-w63x-4vj8-p867- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
Missing Authorization vulnerability in Drupal Config Pages allows Forceful Browsing.
This issue affects Config Pages: from 0.0.0 before 2.18.0.
- Record
CVE-2025-8361- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVDRUPAL-CONTRIB-2025-093 No score
This module enables you to access an edit page for a config page.
The module doesn't sufficiently check the access permissions (hook_ENTITY_TYPE_access() wasn't taken into account).
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit ID config page" and that it only affects sites that have access restricted via the hook_ENTITY_TYPE_access() hook.
- Record
DRUPAL-CONTRIB-2025-093- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/config_pagesPackagist:https://packages.drupal.org/8 |
before 2.18.0 | 2.18.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-8361 is a high vulnerability (CVSS 7.6) in Config Pages Project Pages, published July 30, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 22nd percentile. Fixed in drupal/config_pages 2.18.0.