High severityNVD Advisory· Published Oct 29, 2025· Updated Oct 30, 2025

CivicTheme Design System - Moderately critical - Information disclosure - SA-CONTRIB-2025-112

CVE-2025-12082

Description

Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
drupal/civicthemePackagist	< 1.12.0	1.12.0

Affected products

ghsa-coords
pkg:composer/drupal/civictheme
Range: < 1.12.0
Drupal/CivicTheme Design Systemcpe-rescue
Range: 0.0.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-qxr9-f877-9842ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-12082ghsaADVISORY
www.drupal.org/sa-contrib-2025-112ghsaWEB

News mentions

No linked articles in our index yet.

Severity

highFrom advisory

Numeric CVSS not yet published. Severity reported by the issuing advisory.

EPSS

Probability of exploitation in the next 30 days.

0.28%

VYPR risk score

Composite of severity, exploitation, and reach.

0.46medium

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-863
Incorrect Authorization

CVE ID

CVE-2025-12082

Credits

LR
Lee Rowlands (larowlan)
finder
DW
Drew Webber (mcdruid)
coordinator
GK
Greg Knaddison (greggles)
coordinator
LR
Lee Rowlands (larowlan)
coordinator
AC
Alan Cole (alan.cole)
remediation developer
D(
Daniel (danielgry)
remediation developer
FM
Fiona Morrison (fionamorrison23)
remediation developer
JF
Joshua Fernandes (joshua1234511)
remediation developer
LR
Lee Rowlands (larowlan)
remediation developer
RG
Richard Gaunt (richardgaunt)
remediation developer
SG
Suchi Garg (gargsuchi)
remediation developer