CVE-2025-9549

CVE-2025-9549: Facets - Moderately critical - Information Disclosure - SA-CONTRIB-2025-099

Vendor Drupal

Product Facets

Weakness CWE-862 · Missing authorization

Published October 10, 2025

Last update October 15, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Missing Authorization vulnerability in Drupal Facets allows Forceful Browsing.This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.

Key dates

02Disclosure timeline

October 10, 2025 CVE published

October 15, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-9549 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2024-5669 XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2023-52177 WordPress Integrate Google Drive plugin <= 1.3.3 - Broken Access Control vulnerability CVE-2024-38506 CVE-2023-5416 Funnelforms Free <= 3.4 - Missing Authorization to Category Deletion CVE-2023-3125 B2BKing <= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Price Modification

Identifiers

CVE CVE-2025-9549

CWE CWE-862

Affected versions

Vendor Drupal

Product Facets

Affected ≥ 0.0.0 and < 2.0.10

Vendor Drupal

Product Facets

Affected ≥ 3.0.0 and < 3.0.1