GHSA-mhpg-hpj5-73r2
Low · 3.7CVSS
3.7
EPSS
—
Published
Nov 18, 2025
CISA due date
—
The record
Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | drupal/core | 10.5.0 | 10.5.6 |
| Packagist | drupal/core | 11.0.0 | 11.1.9 |
| Packagist | drupal/core | 11.2.0 | 11.2.8 |
| Packagist | drupal/core | 7.0 | 7.103 |
| Packagist | drupal/core | 8.0.0 | 10.4.9 |
| Bitnami | drupal | 8.0.0 | 10.4.9 |
| packagist | drupal/core | 10.5.0 | 10.5.6 |
| packagist | drupal/core | 11.0.0 | 11.1.9 |
| packagist | drupal/core | 11.2.0 | 11.2.8 |
| packagist | drupal/core | 7.0 | 7.103 |
| packagist | drupal/core | 8.0.0 | 10.4.9 |
Related vulnerabilities
- CVE-2025-13083 Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels Same vulnerability
- GHSA-83v7-c2cf-p9c2 Drupal core allows Forceful Browsing Also affects drupal/core
- GHSA-h89p-5896-f4q8 Drupal core allows Content Spoofing Also affects drupal/core
- GHSA-m6vv-vcj8-w8m7 Drupal core allows Object Injection Also affects drupal/core
- CVE-2025-13081 Drupal core allows Object Injection Also affects drupal/core
- CVE-2025-13082 Drupal core allows Content Spoofing Also affects drupal/core
- CVE-2025-13080 Drupal core allows Forceful Browsing Also affects drupal/core
- CVE-2024-12393 Drupal Core Cross-Site Scripting (XSS) Also affects drupal/core