Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

Vulnerability

Description CVE-2025-31673 is an incorrect authorization vulnerability in Drupal core's Actions system, specifically affecting bulk operations on content pages like /admin/content. The bug allows users to modify certain fields through bulk actions (e.g., making content sticky, promoting to front page, publishing/unpublishing) without having the individual field-level permissions that would normally be required. This occurs because the core Actions system fails to properly enforce permissions for these bulk operations, effectively bypassing the intended access controls [2].

Exploitation

An attacker must have access to the admin content page or a custom view that utilizes bulk operations, and must already have permission to edit nodes. The vulnerability is mitigated by these prerequisites, but once met, the attacker can select multiple nodes and apply bulk actions that should be restricted. For example, a user with only edit permission on specific fields could still change the sticky or published status of content using bulk operations [3].

Impact

Successful exploitation allows an attacker to forcibly modify content attributes such as sticky, promoted, published, or unpublish status across multiple nodes simultaneously. This could lead to unauthorized changes in content visibility and presentation, potentially disrupting site operations or causing defacement. The vulnerability does not grant full administrative access but compromises the integrity of content management [2][3].

Mitigation

The vulnerability has been addressed in Drupal core versions: 10.3.13, 10.4.3, 11.0.12, and 11.1.3. Users running older versions should update immediately. Drupal versions prior to 10.3 are end-of-life and no longer receive security updates. Note that the bulk actions for sticky, promote, publish, and related operations now require the "Administer content" permission in the fixed releases [3].