CVE-2025-31685 Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014

Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10...

CVE-2025-31685

CVE-2025-31685 affects Drupal Open Social. A Missing Authorization vulnerability allows Forceful Browsing across Open Social versions affected: 0.0.0–12.3.10 and 12.4.0–12.4.9. Root cause is lack of proper access control, enabling unauthenticated access to otherwise restricted resources. Reported...

PT-2025-13849 · Drupal · Open Social

Name of the Vulnerable Software and Affected Versions: Open Social versions 0.0.0 through 12.3.10 Open Social versions 12.4.0 through 12.4.9 Description: The issue is related to a Missing Authorization vulnerability in Drupal Open Social, which allows Forceful Browsing. Recommendations: For Open...

Drupal Open Social 安全漏洞

Drupal Open Social is a Drupal-based social networking platform solution from the Drupal community designed to provide a complete social networking capability for businesses, organizations or communities. A security vulnerability exists in Drupal Open Social versions prior to 12.3.11 and 12.4.0...

Drupal Open Social 安全漏洞

Drupal Open Social is a Drupal-based social networking platform solution from the Drupal community designed to provide a complete social networking capability for businesses, organizations or communities. A security vulnerability exists in Drupal Open Social versions prior to 12.3.11 and 12.4.0...

DRUPAL-CONTRIB-2025-015

Open Social is a Drupal distribution for online communities, which ships with a default module to invite users to groups and events. Invites for a specific user can be seen under certain conditions. The issue is mitigated for events by the fact that social\event\max\enroll has to be enabled...

DRUPAL-CONTRIB-2025-014

Open Social is a Drupal distribution for online communities, which ships with a default optional module social\language to make your platform multilingual. Some site administration configuration does not correctly check access when trying to translate allowing unauthorised people to translate the...

PT-2025-13850

Name of the Vulnerable Software and Affected Versions Open Social versions 0.0.0 through 12.3.10 Open Social versions 12.4.0 through 12.4.9 Description The issue is related to a Missing Authorization vulnerability in Drupal Open Social, which allows Forceful Browsing. Recommendations For Open...

Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015

Open Social is a Drupal distribution for online communities, which ships with a default module to invite users to groups and events. Invites for a specific user can be seen under certain conditions. The issue is mitigated for events by the fact that socialeventmaxenroll has to be enabled...

Drupal Open Social module < 12.3.11,12.4.0-12.4.9 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Robert Ragas robertragas in WordPress Module Open Social versions 12.3.11,12.4.0-12.4.9...

Drupal Open Social module < 12.3.11,12.4.0-12.4.9 - Unauthenticated Multiple Vulnerabilities vulnerability

Unauthenticated Multiple Vulnerabilities vulnerability discovered by Robert Ragas robertragas in WordPress Module Open Social versions 12.3.11,12.4.0-12.4.9...

Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014

Open Social is a Drupal distribution for online communities, which ships with a default optional module sociallanguage to make your platform multilingual. Some site administration configuration does not correctly check access when trying to translate allowing unauthorised people to translate thes...

The vulnerability of the Open Social CMS system’s Drupal module, related to insufficient control over the frequency of interactions, allows attackers to trigger a service failure.

The vulnerability of the Open Social CMS system, Drupal, is related to insufficient control over the frequency of interactions. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

The vulnerability of the Open Social CMS system’s Drupal module, related to access control deficiencies, allows attackers to bypass security restrictions.

The vulnerability of the Open Social CMS system, Drupal, is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass security restrictions remotely...

The vulnerability of the social_group_flexible_group configuration in the Drupal Open Social CMS system allows a hacker to gain unauthorized access to protected information.

The vulnerability of the socialgroupflexiblegroup configuration in the Drupal Open Social CMS system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Open Social CMS system’s Drupal module, related to the lack of protective measures for website structures, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the Open Social CMS system, Drupal, is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

The vulnerability of the Open Social CMS system’s Drupal module, related to deficiencies in authentication procedures, allows attackers to circumvent security restrictions and execute a forced browsing attack.

The vulnerability of the Open Social CMS system, Drupal, is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute a Forceful Browsing attack...

Drupal Open Social allows Functionality Misuse

The distribution didn't validate the flood control limits on the password reset form correctly resulting in a potential attacker flooding the password reset which could result in a Denial of Service. Fortunately the message does not disclose any information to the attacker...

CVE-2024-13312

Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 11.8.0 before 12.3.10, from 12.4.0 before 12.4.9...

Missing Authorization

Overview goalgorilla/opensocial is a distribution for building social communities and intranets. Affected versions of this package are vulnerable to Missing Authorization where newly uploaded files were no longer stored in the private file system as intended. An attacker can gain unauthorized...