CVE-2025-31686: Drupal Open Social Missing Authorization Vulnerability
Summary
CVE-2025-31686: Drupal Open Social Missing Authorization vulnerability. Affects goalgorilla/open_social across 2 version ranges.
< 12.3.11
>= 12.4.0, < 12.4.10
Fixed in 12.3.11 or 12.4.10, depending on the release line you run. How to fix ↓
Also tracked for
- drupal/social · Packagist:https://packages.drupal.org/8
The same CVE-2025-31686 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal Open Social is a community-driven distribution of Drupal designed for social networking and community engagement. It provides features such as user profiles, activity streams, and content sharing. However, certain versions of Open Social are vulnerable to a Missing Authorization issue, which can lead to unauthorized access to restricted areas of the application.
Vulnerability Detail
The Missing Authorization vulnerability in Drupal Open Social allows for forceful browsing, where an attacker can access restricted content without proper authentication. This issue arises due to insufficient checks on user permissions, making it possible for unauthorized users to view or manipulate data they should not have access to. The vulnerability affects versions from 0.0.0 before 12.3.11 and from 12.4.0 before 12.4.10.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 12.3.1112.3.11composer require goalgorilla/open_social:12.3.11 -
>= 12.4.0, < 12.4.1012.4.10composer require goalgorilla/open_social:12.4.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that proper access controls are implemented in your application. Review user roles and permissions to restrict access to sensitive areas until the package can be updated.
Conclusion
The Missing Authorization vulnerability in Drupal Open Social poses a significant risk by allowing unauthorized access to restricted content. It is crucial for users of affected versions to update their packages promptly to ensure the security of their applications.
See every vulnerability recorded for goalgorilla/open_social →
FAQ
The vulnerability is a Missing Authorization issue that allows unauthorized users to access restricted content.
Versions from 0.0.0 before 12.3.11 and from 12.4.0 before 12.4.10 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner.
Implement strict access controls and review user permissions to mitigate the risk until you can apply the patch.
Detailed information can be found in the advisory database at GitHub or through the official Drupal security announcements.
References
Related vulnerabilities
Recent vulnerabilities recorded for goalgorilla/open_social.
