Description
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.
Published: 2025-11-18
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-mhpg-hpj5-73r2 Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels
References
Link Providers
https://www.drupal.org/sa-core-2025-008 cve-icon cve-icon
History

Thu, 08 Jan 2026 16:00:00 +0000

Type Values Removed Values Added
Description Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8. Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.

Mon, 24 Nov 2025 17:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

Wed, 19 Nov 2025 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Drupal
Drupal drupal
Drupal drupal Core
Vendors & Products Drupal
Drupal drupal
Drupal drupal Core

Tue, 18 Nov 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 18 Nov 2025 17:15:00 +0000

Type Values Removed Values Added
Description Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.
Title Drupal core - Moderately critical - Information disclosure - SA-CORE-2025-008
Weaknesses CWE-525
References

Subscriptions

Drupal Drupal Drupal Core
cve-icon MITRE

Status: PUBLISHED

Assigner: drupal

Published:

Updated: 2026-01-16T20:14:00.799Z

Reserved: 2025-11-12T18:26:39.713Z

Link: CVE-2025-13083

cve-icon Vulnrichment

Updated: 2025-11-18T20:31:28.587Z

cve-icon NVD

Status : Modified

Published: 2025-11-18T17:15:59.313

Modified: 2026-01-08T16:15:44.063

Link: CVE-2025-13083

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-11-19T10:47:44Z

Weaknesses