CVE-2025-12082 - Vulnerability Details - OpenCVE

Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Drupal	Civictheme Design System Drupal

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2025-112

History

Thu, 30 Oct 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 30 Oct 2025 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal civictheme Design System Drupal drupal
Vendors & Products		Drupal Drupal civictheme Design System Drupal drupal

Wed, 29 Oct 2025 23:30:00 +0000

Type	Values Removed	Values Added
Description		Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.
Title		CivicTheme Design System - Moderately critical - Information disclosure - SA-CONTRIB-2025-112
Weaknesses		CWE-863
References		https://www.drupal.org/sa-contrib-2025-112

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-10-29T23:14:19.017Z

Updated: 2025-10-30T14:41:28.623Z

Reserved: 2025-10-22T16:06:21.893Z

Link: CVE-2025-12082

Vulnrichment

Updated: 2025-10-30T14:41:20.464Z

NVD

Status : Awaiting Analysis

Published: 2025-10-30T00:15:34.547

Modified: 2025-10-30T15:15:35.807

Link: CVE-2025-12082

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12082", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-10-22T16:06:21.893Z", "datePublished": "2025-10-29T23:14:19.017Z", "dateUpdated": "2025-10-30T14:41:28.623Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/civictheme", "defaultStatus": "unaffected", "product": "CivicTheme Design System", "repo": "https://git.drupalcode.org/project/civictheme", "vendor": "Drupal", "versions": [{"lessThan": "1.12.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "remediation developer", "value": "Alan Cole (alan.cole)"}, {"lang": "en", "type": "remediation developer", "value": "Daniel (danielgry)"}, {"lang": "en", "type": "remediation developer", "value": "Fiona Morrison (fionamorrison23)"}, {"lang": "en", "type": "remediation developer", "value": "Suchi Garg (gargsuchi)"}, {"lang": "en", "type": "remediation developer", "value": "Joshua Fernandes (joshua1234511)"}, {"lang": "en", "type": "remediation developer", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "remediation developer", "value": "Richard Gaunt (richardgaunt)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "coordinator", "value": "Drew Webber (mcdruid)"}], "datePublic": "2025-10-22T16:34:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.<p>This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.</p>"}], "value": "Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0."}], "impacts": [{"capecId": "CAPEC-87", "descriptions": [{"lang": "en", "value": "CAPEC-87 Forceful Browsing"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-10-29T23:14:19.017Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2025-112"}], "source": {"discovery": "UNKNOWN"}, "title": "CivicTheme Design System - Moderately critical - Information disclosure - SA-CONTRIB-2025-112", "x_generator": {"engine": "Vulnogram 0.4.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-10-30T14:41:02.629401Z", "id": "CVE-2025-12082", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T14:41:28.623Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-12082", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-30T14:41:02.629401Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T14:41:20.464Z"}}], "cna": {"title": "CivicTheme Design System - Moderately critical - Information disclosure - SA-CONTRIB-2025-112", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "remediation developer", "value": "Alan Cole (alan.cole)"}, {"lang": "en", "type": "remediation developer", "value": "Daniel (danielgry)"}, {"lang": "en", "type": "remediation developer", "value": "Fiona Morrison (fionamorrison23)"}, {"lang": "en", "type": "remediation developer", "value": "Suchi Garg (gargsuchi)"}, {"lang": "en", "type": "remediation developer", "value": "Joshua Fernandes (joshua1234511)"}, {"lang": "en", "type": "remediation developer", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "remediation developer", "value": "Richard Gaunt (richardgaunt)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Lee Rowlands (larowlan)"}, {"lang": "en", "type": "coordinator", "value": "Drew Webber (mcdruid)"}], "impacts": [{"capecId": "CAPEC-87", "descriptions": [{"lang": "en", "value": "CAPEC-87 Forceful Browsing"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/civictheme", "vendor": "Drupal", "product": "CivicTheme Design System", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.12.0", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/civictheme", "defaultStatus": "unaffected"}], "datePublic": "2025-10-22T16:34:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2025-112"}], "x_generator": {"engine": "Vulnogram 0.4.0"}, "descriptions": [{"lang": "en", "value": "Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.", "supportingMedia": [{"type": "text/html", "value": "Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.<p>This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-10-29T23:14:19.017Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12082", "state": "PUBLISHED", "dateUpdated": "2025-10-30T14:41:28.623Z", "dateReserved": "2025-10-22T16:06:21.893Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-10-29T23:14:19.017Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}