← All advisories

High severity7.5NVD Advisory· Published Oct 30, 2025· Updated Jun 17, 2026

CVE-2025-9954

CVE-2025-9954

Description

Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
drupal/acquia_damPackagist	< 1.1.5	1.1.5

Affected products

3

Mautic/Dam
cpe:2.3:a:acquia:dam:*:*:*:*:*:drupal:*:*
Range: <1.1.5
ghsa-coords
pkg:composer/drupal/acquia_dam
Range: < 1.1.5
Drupal/Acquia DAMcpe-rescue
Range: 0.0.0

Patches

Vulnerability mechanics

References

3

www.drupal.org/sa-contrib-2025-105nvdPatchVendor AdvisoryWEB
github.com/advisories/GHSA-x957-32v9-m7vgghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-9954ghsaADVISORY

News mentions

0

No linked articles in our index yet.

Severity

HighCVSS v3.1

7.5/ 10

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

Probability of exploitation in the next 30 days.

0.29%

VYPR risk score

Composite of severity, exploitation, and reach.

0.49medium

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-862
Missing Authorization

CVE ID

CVE-2025-9954

Credits

BG
Brandon Goodwin (bgoodie)
finder
CB
Chris Burge (chris burge)
finder
TW
Todd Woofenden (toddwoof)
finder
CT
Cathy Theys (yesct)
coordinator
GK
Greg Knaddison (greggles)
coordinator
C(
cilefen (cilefen)
coordinator
CB
Chris Burge (chris burge)
remediation developer
DM
Damien McKenna (damienmckenna)
remediation developer
JP
Jakob P (japerry)
remediation developer
TW
Todd Woofenden (toddwoof)
remediation developer