CVE-2025-48013: Drupal Quick Node Block Missing Authorization Vulnerability
Summary
CVE-2025-48013: Drupal Quick Node Block Missing Authorization vulnerability. Affects drupal/quick_node_block versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal Quick Node Block is a module designed for the Drupal content management system, enabling users to create blocks that display content from specific nodes. This module enhances the flexibility and usability of Drupal sites by allowing quick access to node content. However, it has been identified to have a Missing Authorization vulnerability that can lead to unauthorized access and manipulation of content.
Vulnerability Detail
The Missing Authorization vulnerability in Drupal Quick Node Block allows for forceful browsing, meaning that an attacker could potentially access restricted content without proper authorization. This issue arises from inadequate checks on user permissions when accessing certain functionalities of the module. If exploited, this vulnerability could lead to unauthorized data exposure and manipulation, impacting the integrity and confidentiality of the site.
How To Fix
Minimum fixed version
2.0.0
This is the first release that contains the fix.
composer require drupal/quick_node_block:2.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the affected functionalities by modifying user roles and permissions within the Drupal admin interface. However, this is not a permanent solution and updating the module is strongly advised.
Conclusion
The Missing Authorization vulnerability in Drupal Quick Node Block poses a moderate risk to users, allowing unauthorized access to content. It is crucial to update to the latest version to mitigate this risk. Utilizing tools like Vulert can further enhance security by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for drupal/quick_node_block →
FAQ
The vulnerability has a CVSS score of 5.3, indicating a moderate level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could lead to unauthorized access to sensitive content, potentially compromising the integrity and confidentiality of your site.
Yes, a patch is available in version 2.0.0 of the Drupal Quick Node Block module. It is recommended to update to this version.
Vulert monitors and alerts for open-source vulnerabilities in software using just the composer.lock file. It provides real-time alerts for vulnerabilities, helping developers maintain secure applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/quick_node_block.
