CVE-2025-31686
Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
- Record
CVE-2025-31686- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2025-9035
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
- Record
EUVD-2025-9035- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m9w8-wxvp-c9gv
Drupal Open Social Missing Authorization vulnerability
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing. This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
- Record
GHSA-m9w8-wxvp-c9gv- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
- Record
CVE-2025-31686- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
- Record
CVE-2025-31686- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVGHSA-m9w8-wxvp-c9gv
Drupal Open Social Missing Authorization vulnerability
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing. This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
- Record
GHSA-m9w8-wxvp-c9gv- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVDRUPAL-CONTRIB-2025-015 No score
Open Social is a Drupal distribution for online communities, which ships with a default module to invite users to groups and events.
Invites for a specific user can be seen under certain conditions.
The issue is mitigated for events by the fact that social_event_max_enroll has to be enabled.
- Record
DRUPAL-CONTRIB-2025-015- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
goalgorilla/open_socialPackagist |
before 12.3.11 | 12.3.11 |
goalgorilla/open_socialPackagist |
12.4.0 up to 12.4.10 | 12.4.10 |
goalgorilla/open_socialPackagist |
before 12.3.11, plus listed versions 1.0.01.0.0-alpha61.0.0-alpha71.0.0-beta11.0.0-beta10 Show 45 moreShow less1.0.0-beta111.0.0-beta121.0.0-beta131.0.0-beta141.0.0-beta21.0.0-beta31.0.0-beta41.0.0-beta51.0.0-beta61.0.0-beta71.0.0-beta81.0.0-beta91.0.0-rc11.0.0-rc21.0.0-rc31.0.0-rc41.0.0-rc51.0.0-rc61.0.0-rc71.0.0-rc81.1.01.10.01.11.01.12.01.13.01.14.01.15.01.16.01.17.01.18.01.19.01.2.01.3.01.4.01.5.01.6.01.7.01.8.01.9.010.0.010.0.110.0.1010.0.1110.0.1210.0.13 |
12.3.11 |
goalgorilla/open_socialPackagist |
12.4.0 up to 12.4.10, plus listed versions 12.4.112.4.212.4.312.4.412.4.5 Show 4 moreShow less12.4.612.4.712.4.812.4.9 |
12.4.10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-31686 is a high vulnerability (CVSS 8.1) in Drupal Open Social, published February 12, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in goalgorilla/open_social 12.3.11.
References
drupal.org/sa-contrib-2025-015
nvd.nist.gov/vuln/detail/CVE-2025-31686
github.com/goalgorilla/open_social/commit/6830b1788616fc24fb3913ce88c5d997a363a5de
git.drupalcode.org/project/social
Left out here: 389 versions. The JSON record has them.