Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Project:
Date:
2025-February-12
Vulnerability:
Access bypass
Affected versions:
<12.3.11 || >=12.4.0 <12.4.10
CVE IDs:
CVE-2025-31685
Description:
Open Social is a Drupal distribution for online communities, which ships with a default (optional) module social_language to make your platform multilingual.
Some site administration configuration does not correctly check access when trying to translate allowing unauthorised people to translate these parts.
The issue is mitigated by the fact that social_language needs to be enabled with more than 1 language.
Solution:
Install the latest version:
- If you use Open Social 12.3.x upgrade to Open Social 12.3.11
- If you use Open Social 12.4.x upgrade to Open Social 12.4.10
Reported By:
Fixed By:
Coordinated By:
- Greg Knaddison (greggles) of the Drupal Security Team
