Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2025-31686: Open Social lets unauthorized users view private data
CVE-2025-31686 · published 1 year ago
Summary
Versions of Open Social up to 12.3.11 and 12.4.9 allow users to access pages they should not see. This can expose internal information or let people navigate the site without proper permission. Update to the latest release of Open Social to close the gap.
What to do
- Update goalgorilla open_social to version 12.3.11.
- Update goalgorilla open_social to version 12.4.10.
- Update drupal drupal/social to version 12.4.10.
- Update goalgorilla goalgorilla/open_social to version 12.3.11.
- Update goalgorilla goalgorilla/open_social to version 12.4.10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | goalgorilla | open_social |
< 12.3.11 >= 12.4.0, < 12.4.10 Fix: upgrade to 12.3.11
|
| Packagist:https://packages.drupal.org/8 | drupal | drupal/social |
>= 12.4.0, < 12.4.10 Fix: upgrade to 12.4.10
|
| Packagist | goalgorilla | goalgorilla/open_social |
< 12.3.11 >= 12.4.0, < 12.4.10 Fix: upgrade to 12.3.11
|
| – | getopensocial | open_social |
< 12.3.11 >= 12.4.0, < 12.4.10 cpe:2.3:a:getopensocial:open_social:*:*:*:*:*:drupal:*:* |
Original advisory text
Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
References
- https://github.com/goalgorilla/open_social/commit/6830b1788616fc24fb3913ce88c5d9...
- https://github.com/goalgorilla/open_social/commit/6fa5181901d4be3a64793f29c6ce0c...
- https://github.com/advisories/GHSA-m9w8-wxvp-c9gv
- https://nvd.nist.gov/vuln/detail/CVE-2025-31686 Vendor Advisory
- https://git.drupalcode.org/project/social URL
- https://www.drupal.org/project/social URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31686... Vendor Advisory
- https://github.com/goalgorilla/open_social Product
- https://www.drupal.org/sa-contrib-2025-015 URL
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.9
Critical
Type
CWE-862Missing Authorization
Timeline
Published31 Mar 2025
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-m9w8-wxvp-c9gv · GHSA
CVE-2025-31686 · NVD
DRUPAL-CONTRIB-2025-015 · OSV
GHSA-m9w8-wxvp-c9gv · OSV
CVE-2025-31686 · OSV
Track software like this
Free during beta