CVE-2025-13083: Drupal Core Access Control Misconfiguration Vulnerability
Summary
CVE-2025-13083: Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels. Affects drupal/core across 4 version ranges.
>= 8.0.0, < 10.4.9
>= 10.5.0, < 10.5.6
>= 11.0.0, < 11.1.9
>= 11.2.0, < 11.2.8
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- drupal · Bitnami
The same CVE-2025-13083 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Drupal is a widely used open-source content management system (CMS) that enables users to create and manage websites easily. It offers a flexible framework for building various types of websites, from personal blogs to large enterprise applications. The core of Drupal includes essential features such as user management, content creation, and access control. However, misconfigurations in access control settings can lead to vulnerabilities, exposing sensitive information to unauthorized users.
Vulnerability Detail
The vulnerability identified as CVE-2025-13083 in Drupal core allows for the exploitation of incorrectly configured access control security levels. This issue arises when sensitive information is cached in web browsers, potentially allowing unauthorized users to access this data. The affected versions of Drupal core include those from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, and from 11.2.0 before 11.2.8. The ramifications of this vulnerability could lead to data breaches, where sensitive user information may be exposed to malicious actors.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 10.4.910.4.9composer require drupal/core:10.4.9 -
>= 10.5.0, < 10.5.610.5.6composer require drupal/core:10.5.6 -
>= 11.0.0, < 11.1.911.1.9composer require drupal/core:11.1.9 -
>= 11.2.0, < 11.2.811.2.8composer require drupal/core:11.2.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can clear their web browser cache regularly to minimize the risk of sensitive information being exposed. Additionally, reviewing and tightening access control settings within the Drupal configuration can help mitigate the impact of this vulnerability until a full update is applied.
Conclusion
In summary, CVE-2025-13083 is a significant vulnerability in Drupal core that can lead to unauthorized access to sensitive information due to misconfigured access control settings. It is crucial for users to update their Drupal installations to the latest patched versions to mitigate this risk. Regular monitoring and configuration reviews can further enhance security.
See every vulnerability recorded for drupal/core →
FAQ
CVE-2025-13083 is a vulnerability in Drupal core that allows for the exploitation of incorrectly configured access control security levels, potentially exposing sensitive information.
The affected versions include Drupal core from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, and from 11.2.0 before 11.2.8.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By utilizing the Vulert playground at Vulert Scanner, you can check if your application is affected without requiring any signup.
If an immediate update is not possible, clear your web browser cache regularly and review your access control settings to minimize exposure to sensitive information.
The CVSS score of this vulnerability is 3.7, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for drupal/core.
