CVE-2025-9549

MediumCVSS 6.5

Published: 10/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

A missing authorization vulnerability in Drupal Facets allows Forceful Browsing. This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.

Risk Assessment

Attackers may access resources or functionality they are not authorized for, potentially leading to information disclosure or unauthorized actions.

Recommendation

Update the Facets module to version 2.0.10 or 3.0.1 (depending on the branch in use) to fix the vulnerability.

Other vulnerabilities in Drupal Facets

CVE-2025-9550Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS). This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.

Original NVD description (English source)

Missing Authorization vulnerability in Drupal Facets allows Forceful Browsing.This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS