Project: 
Open Social
Date: 
2025-June-25
Security risk: 
Moderately critical 13 ∕ 25 AC:None/A:User/CI:None/II:Some/E:Theoretical/TD:All
Vulnerability: 
Cross Site Request Forgery
Affected versions: 
<12.3.14 || >=12.4.0 <12.4.13
CVE IDs: 
CVE-2025-48921
Description: 

Open Social is a Drupal distribution for online communities, which ships with a default module that allows users to enroll in events.

The module doesn't sufficiently protect certain routes from Cross Site Request Forgery (CSRF) attacks. Users can be tricked into accepting or rejecting these enrollments.

This issue only affects sites that have event enrollments enabled for an event.

Solution: 

Install the latest version:

Reported By: 
Fixed By: 
Coordinated By: