Critical severity9.1NVD Advisory· Published Mar 31, 2025· Updated Jun 17, 2026

CVE-2025-31685

Description

Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
goalgorilla/open_socialPackagist	< 12.3.11	12.3.11
goalgorilla/open_socialPackagist	>= 12.4.0, < 12.4.10	12.4.10

Affected products

Getopensocial/Open Social
cpe:2.3:a:getopensocial:open_social:*:*:*:*:*:drupal:*:*
Range: <12.3.11
ghsa-coords
pkg:composer/goalgorilla/open_social
Range: < 12.3.11
Drupal/Open Socialcpe-rescue
Range: 0.0.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-gf72-h4cp-wcm4ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-31685ghsaADVISORY
www.drupal.org/sa-contrib-2025-014nvdVendor AdvisoryWEB
github.com/goalgorilla/open_social/commit/52c531e156fb8653e47ab99df432c4fb9651f36eghsaWEB
github.com/goalgorilla/open_social/commit/6ebeed01c83dc4947a5c3689bc33b4deca574473ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.591
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000