CVE-2025-13080: Drupal core allows Forceful Browsing

November 18, 2025

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.

References

github.com/advisories/GHSA-83v7-c2cf-p9c2
github.com/drupal/core
nvd.nist.gov/vuln/detail/CVE-2025-13080
www.drupal.org/sa-core-2025-005

Code Behaviors & Features

Detect and mitigate CVE-2025-13080 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →