CVE-2025-31685

The Drupal Open Social platform (specifically the goalgorilla/open_social package) is vulnerable to a Missing Authorization flaw allowing Forceful Browsing . The root cause is a site administration configuration that fails to properly check access permissions when attempting to translate the plat...

CVE-2025-31686

The Drupal Open Social distribution is vulnerable to a Missing Authorization vulnerability, which enables Forceful Browsing . The root cause is insufficient access control checks , allowing unauthorized users to access restricted resources, specifically enabling them to view invites for other spe...

CVE-2024-13240

The Open Social CMS (based on Drupal ) is vulnerable to an improper access control issue in versions prior to 12.05 . The vulnerability allows for the collection of data from common resource locations because users can create public content even when such actions should be restricted. This could ...

CVE-2024-13273

The Drupal Open Social CMS is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. Specifically, the Social Embed submodule fails to sufficiently validate added URLs, which could lead to Stored XSS or Blind SSRF if the module is enabled. Thi...

CVE-2024-13241

The Drupal Open Social CMS (versions 0.0.0 through 12.0.4) is vulnerable to an improper authorization issue within the optional social_group_flexible_group module. The root cause stems from insufficient validation of group updates, which may allow attackers operating remotely to bypass authorizat...

CVE-2024-13312

The goalgorilla/open_social Drupal distribution is vulnerable to a Missing Authorization flaw that enables Forceful Browsing . The root cause is that newly uploaded files are not correctly stored in the private file system as intended by the optional social_file_private module; instead, they are ...

CVE-2024-13274

The Drupal Open Social CMS distribution is vulnerable to Improper Control of Interaction Frequency due to incorrect validation of flood control limits on the password reset form . A malicious actor could exploit this to flood the password reset functionality, potentially causing a Denial of Servi...

CVE-2025-48921

A Cross-Site Request Forgery (CSRF) vulnerability exists in Drupal Open Social , a social networking platform. The flaw stems from a default module that fails to sufficiently protect certain routes from CSRF attacks, specifically those involving event enrollments . This allows an attacker to tric...