CVE-2025-13080: Drupal Core Forceful Browsing Vulnerability
Summary
CVE-2025-13080: Drupal core allows Forceful Browsing. Affects drupal/core across 4 version ranges.
>= 8.0.0, < 10.4.9
>= 10.5.0, < 10.5.6
>= 11.0.0, < 11.1.9
>= 11.2.0, < 11.2.8
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2025-13080 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Drupal is a widely-used open-source content management system (CMS) that enables users to create and manage websites easily. It is known for its flexibility, scalability, and extensive community support. However, certain versions of Drupal core are susceptible to a Forceful Browsing vulnerability, which can allow unauthorized users to access restricted content or functionalities.
Vulnerability Detail
The vulnerability arises from an improper check for unusual or exceptional conditions within Drupal core. This flaw allows attackers to bypass access controls, potentially leading to unauthorized access to sensitive information or functionalities. The affected versions include Drupal core from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, and from 11.2.0 before 11.2.8. The implications of this vulnerability can range from data exposure to complete system compromise, depending on the access level of the compromised accounts.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 10.4.910.4.9composer require drupal/core:10.4.9 -
>= 10.5.0, < 10.5.610.5.6composer require drupal/core:10.5.6 -
>= 11.0.0, < 11.1.911.1.9composer require drupal/core:11.1.9 -
>= 11.2.0, < 11.2.811.2.8composer require drupal/core:11.2.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to sensitive areas of your site through additional authentication measures or by implementing custom access controls until the update can be applied.
Conclusion
The CVE-2025-13080 vulnerability in Drupal core presents a significant risk by allowing Forceful Browsing, which can lead to unauthorized access. It is crucial for users to update their installations to the latest patched versions to mitigate this risk.
See every vulnerability recorded for drupal/core →
FAQ
The vulnerability allows for Forceful Browsing, enabling unauthorized users to access restricted content.
Affected versions include Drupal core from 8.0.0 before 10.4.9, 10.5.0 before 10.5.6, 11.0.0 before 11.1.9, and 11.2.0 before 11.2.8.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Consequences can include unauthorized access to sensitive information, data exposure, and potential system compromise.
It is recommended to regularly check for updates and apply them promptly to ensure your installation remains secure.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
