BaseFortify

Publication date: 2025-10-10

Last updated on: 2026-01-05

Assigner: Drupal.org

Description

Missing Authorization vulnerability in Drupal Facets allows Forceful Browsing.This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-10

Last Modified

2026-01-05

Generated

2026-07-06

AI Q&A

2025-10-11

EPSS Evaluated

2026-07-05

NVD

CVE-2025-9549

Affected Vendors & Products

Vendor	Product	Version / Range
facets_project	facets	to 2.0.10 (exc)
facets_project	facets	From 3.0.0 (inc) to 3.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a Missing Authorization issue in the Drupal Facets module, which allows Forceful Browsing. This means that unauthorized users can access parts of the application or data that should be restricted because the system does not properly check if the user has permission to view those resources.

Impact Analysis

The impact of this vulnerability is that unauthorized users may gain access to sensitive or restricted information or functionality within a Drupal site using the Facets module. This can lead to data exposure, unauthorized actions, or other security breaches.

Hi! I’m here to help you understand CVE-2025-9549. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70