GHSA-gf72-h4cp-wcm4

Drupal Open Social Missing Authorization vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-31685

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	goalgorilla/open_social	< 12.3.11	12.3.11
Packagist	goalgorilla/open_social	>= 12.4.0, < 12.4.10	12.4.10

Details

As written in the advisory (Markdown source, shown as plain text).

Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing. This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-31685 advisory
https://github.com/goalgorilla/open_social/commit/52c531e156fb8653e47ab99df432c4fb9651f36e web
https://github.com/goalgorilla/open_social/commit/6ebeed01c83dc4947a5c3689bc33b4deca574473 web
https://github.com/goalgorilla/open_social package
https://www.drupal.org/sa-contrib-2025-014 web