CVE-2025-31673
published 2025-03-31CVE-2025-31673: Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0…
PriorityP424medium4.6CVSS 3.1
AVNACLPRLUIRSUCLILAN
EPSS
0.27%
18.9th percentile
Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| drupal | core | >= 10.4.0 < 10.4.3 | 10.4.3 |
| drupal | core | >= 11.0.0 < 11.0.12 | 11.0.12 |
| drupal | core | >= 11.1.0 < 11.1.3 | 11.1.3 |
| drupal | core | >= 8.0.0 < 10.3.13 | 10.3.13 |
| drupal | drupal | >= 10.4.0 < 10.4.3 | 10.4.3 |
| drupal | drupal | >= 11.0.0 < 11.0.12 | 11.0.12 |
| drupal | drupal | >= 11.1.0 < 11.1.3 | 11.1.3 |
| drupal | drupal | >= 8.0.0 < 10.3.13 | 10.3.13 |
| drupal | drupal_core | — | — |
| drupal | drupal_core | >= 10.4.0 < 10.4.3 | 10.4.3 |
| drupal | drupal_core | >= 11.0.0 < 11.0.12 | 11.0.12 |
| drupal | drupal_core | >= 11.1.0 < 11.1.3 | 11.1.3 |
| drupal | drupal_core | >= 8.0.0 < 10.3.13 | 10.3.13 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Drupal Core Vulnerable to Forceful Browsing
ghsa·2025-04-01
CVE-2025-31673 [MEDIUM] CWE-863 Drupal Core Vulnerable to Forceful Browsing
Drupal Core Vulnerable to Forceful Browsing
Incorrect Authorization vulnerability in Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
OSV
Drupal Core Vulnerable to Forceful Browsing
osv·2025-04-01
CVE-2025-31673 [MEDIUM] Drupal Core Vulnerable to Forceful Browsing
Drupal Core Vulnerable to Forceful Browsing
Incorrect Authorization vulnerability in Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
OSV
CVE-2025-31673: Bulk operations allow authorized users to modify several nodes at once from the Content page (`/admin/content`)
osv·2025-02-19
CVE-2025-31673 CVE-2025-31673: Bulk operations allow authorized users to modify several nodes at once from the Content page (`/admin/content`)
Bulk operations allow authorized users to modify several nodes at once from the Content page (`/admin/content`). A site builder can also add bulk operations to other pages using Views.
A bug in the core Actions system allows some users to modify some fields using bulk actions that they do not have permission to modify on individual nodes.
This vulnerability is mitigated by the fact that an attacker must have permission to access `/admin/content` or other, custom views and to edit nodes.
In particular, the bulk operations
* Make content sticky
* Make content unsticky
* Promote content to front page
* Publish content
* Remove content from front page
* Unpublish content
now require the "Administer content" permission.
Drupal
Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002
vendor_drupal·2025-02-19
CVE-2025-31673 [MEDIUM] Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002
Title: Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002
Vulnerability Type: Access bypass
Description: Bulk operations allow authorized users to modify several nodes at once from the Content page ( /admin/content ). A site builder can also add bulk operations to other pages using Views. A bug in the core Actions system allows some users to modify some fields using bulk actions that they do not have permission to modify on individual nodes. This vulnerability is mitigated by the fact that an attacker must have permission to access /admin/content or other, custom views and to edit nodes. In particular, the bulk operations Make content sticky Make content unsticky Promote content to front page Publish content Remove content from front page Unpublish content now require t
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-03-31
Published