CVE-2025-48444: Drupal Quick Node Block Missing Authorization Vulnerability
Summary
CVE-2025-48444: Drupal Quick Node Block Missing Authorization vulnerability. Affects drupal/quick_node_block versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Also tracked for
- drupal/quick_node_block · Packagist:https://packages.drupal.org/8
The same CVE-2025-48444 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal Quick Node Block is a module that allows users to create blocks for quick access to specific nodes in a Drupal site. It enhances the user experience by providing easy navigation to content. However, this module has a vulnerability that can lead to unauthorized access to certain functionalities, making it crucial for users to be aware of and address this issue.
Vulnerability Detail
The Missing Authorization vulnerability in Drupal Quick Node Block allows for forceful browsing, meaning that users can access content or functionalities that they should not have permission to view or interact with. This vulnerability affects versions from 0.0.0 up to, but not including, 2.0.0. The lack of proper authorization checks can lead to unauthorized data exposure and manipulation, posing a significant risk to the integrity and confidentiality of the application.
How To Fix
Minimum fixed version
2.0.0
This is the first release that contains the fix.
composer require drupal/quick_node_block:2.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the affected functionalities by modifying user permissions within your Drupal site. Ensure that only authorized users have access to sensitive content until the module is updated.
Conclusion
The Missing Authorization vulnerability in the Drupal Quick Node Block module poses a significant risk to users by allowing unauthorized access to functionalities. It is crucial to update to version 2.0.0 or later to mitigate this risk. Additionally, users can utilize Vulert to monitor their applications for vulnerabilities effectively.
See every vulnerability recorded for drupal/quick_node_block →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
Versions from 0.0.0 up to, but not including, 2.0.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential risks include unauthorized access to sensitive content and functionalities, which can lead to data exposure and manipulation.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the composer.lock file.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/quick_node_block.
