Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

published 2025-02-19 20 mo ago modified 2026-09-19 51 d ago also BIT-drupal-2025-31673 , DRUPAL-CORE-2025-002 , EUVD-2025-9043 , GHSA-wpp8-fjgf-pwc7

cvss: 4.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 24%
public exploits: 0; none known

Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

Patch / fix

fixed in 3

packagist drupal/core 10.3.13, 10.4.3, 11.0.12, 11.1.3
bitnami drupal 10.4.3, 11.1.3
Drupal Drupal core 10.3.13, 10.4.3, 11.0.12, 11.1.3

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-31673 updated 2026-06-28 cvss 6.3

drupal: Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 18 mo ago (2025-04-29)

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	4.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
GitHub	3.1	4.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CNA	3.1	4.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
OSV	3.1	4.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	drupal/core	>=8.0.0, <10.3.13 >=10.4.0, <10.4.3 >=11.0.0, <11.0.12 >=11.1.0, <11.1.3	10.3.13 10.4.3 11.0.12 11.1.3
bitnami	drupal	>=8.0.0, <10.4.3 >=11.0.0, <11.1.3	10.4.3 11.1.3

Affected products

Drupal Drupal core

Classification

Weakness

CWE-863 Incorrect Authorization

References

drupal.org /sa-core-2025-002
web, vendor-advisory, advisory
nvd.nist.gov /vuln/detail/CVE-2025-31673
advisory, web
github.com /drupal/core
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary