CVE-2025-13083
Low · 3.7Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels
CVSS
3.7
EPSS
0.3%
Published
Nov 18, 2025
CISA due date
—
The record
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | drupal/core | 10.5.0 | 10.5.6 |
| Packagist | drupal/core | 11.0.0 | 11.1.9 |
| Packagist | drupal/core | 11.2.0 | 11.2.8 |
| Packagist | drupal/core | 7.0 | 7.103 |
| Packagist | drupal/core | 8.0.0 | 10.4.9 |
| Bitnami | drupal | 8.0.0 | 10.4.9 |
| packagist | drupal/core | 10.5.0 | 10.5.6 |
| packagist | drupal/core | 11.0.0 | 11.1.9 |
| packagist | drupal/core | 11.2.0 | 11.2.8 |
| packagist | drupal/core | 7.0 | 7.103 |
| packagist | drupal/core | 8.0.0 | 10.4.9 |
Related vulnerabilities
- GHSA-mhpg-hpj5-73r2 Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels Same vulnerability
- GHSA-83v7-c2cf-p9c2 Drupal core allows Forceful Browsing Also affects drupal/core
- GHSA-h89p-5896-f4q8 Drupal core allows Content Spoofing Also affects drupal/core
- GHSA-m6vv-vcj8-w8m7 Drupal core allows Object Injection Also affects drupal/core
- CVE-2025-13081 Drupal core allows Object Injection Also affects drupal/core
- CVE-2025-13082 Drupal core allows Content Spoofing Also affects drupal/core
- CVE-2025-13080 Drupal core allows Forceful Browsing Also affects drupal/core
- CVE-2024-12393 Drupal Core Cross-Site Scripting (XSS) Also affects drupal/core