High severity8.1NVD Advisory· Published Mar 31, 2025· Updated Jun 17, 2026

CVE-2025-31686

Description

Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
goalgorilla/open_socialPackagist	< 12.3.11	12.3.11
goalgorilla/open_socialPackagist	>= 12.4.0, < 12.4.10	12.4.10

Affected products

Getopensocial/Open Social
cpe:2.3:a:getopensocial:open_social:*:*:*:*:*:drupal:*:*
Range: <12.3.11
ghsa-coords
pkg:composer/goalgorilla/open_social
Range: < 12.3.11
Drupal/Open Socialcpe-rescue
Range: 0.0.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-m9w8-wxvp-c9gvghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-31686ghsaADVISORY
www.drupal.org/sa-contrib-2025-015nvdVendor AdvisoryWEB
github.com/goalgorilla/open_social/commit/6830b1788616fc24fb3913ce88c5d997a363a5deghsaWEB
github.com/goalgorilla/open_social/commit/6fa5181901d4be3a64793f29c6ce0c9bd535a42fghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000