CVE-2025-31685: Drupal Open Social Missing Authorization Vulnerability
Summary
CVE-2025-31685: Drupal Open Social Missing Authorization vulnerability. Affects goalgorilla/open_social across 2 version ranges.
< 12.3.11
>= 12.4.0, < 12.4.10
Fixed in 12.3.11 or 12.4.10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal Open Social is a popular open-source social networking distribution built on the Drupal content management system. It provides a robust platform for creating social applications, featuring user profiles, groups, and community engagement tools. However, it has been identified to have a Missing Authorization vulnerability that can lead to unauthorized access to sensitive areas of the application.
Vulnerability Detail
The Missing Authorization vulnerability in Drupal Open Social allows for forceful browsing, where an attacker can access restricted areas of the application without proper authorization. This issue affects versions from 0.0.0 before 12.3.11 and from 12.4.0 before 12.4.10. The vulnerability stems from inadequate checks on user permissions, enabling unauthorized users to view or manipulate data they should not have access to.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 12.3.1112.3.11composer require goalgorilla/open_social:12.3.11 -
>= 12.4.0, < 12.4.1012.4.10composer require goalgorilla/open_social:12.4.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to sensitive areas of the application by implementing additional access controls or by disabling features that are vulnerable until the package can be updated.
Conclusion
The Missing Authorization vulnerability in Drupal Open Social poses a significant risk by allowing unauthorized access to sensitive areas of the application. It is crucial for users to update to the latest patched versions to mitigate this risk. Implementing temporary workarounds can provide additional security until updates are applied.
See every vulnerability recorded for goalgorilla/open_social →
FAQ
The vulnerability is a Missing Authorization issue that allows unauthorized access to restricted areas of the application.
Versions from 0.0.0 before 12.3.11 and from 12.4.0 before 12.4.10 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, consider implementing additional access controls as a temporary workaround.
More information can be found in the advisory database at GitHub or through the official Drupal security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for goalgorilla/open_social.
