CivicTheme Design System
CVE-2025-12082
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Drupal site running CivicTheme < 1.12.0
-
ExploitRequest restricted resource URL directly
-
ExecutionAuthorization check bypassed (forceful browsing)
-
ImpactRetrieve unauthorized content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a Drupal site running the CivicTheme Design System module at a version from 0.0.0 up to but not including 1.12.0; exploitation targets resources whose access control is handled by this module's incorrect authorization logic. Per AV:N/AC:L/PR:N/UI:N no authentication, user interaction, or non-default configuration is indicated as required - any reachable instance in the vulnerable range is exposed. The primary limiting factor is deployment scope: only sites that have installed and rely on CivicTheme for access-restricted content are affected, and impact is confined to confidentiality (I:N/A:N), i.e. unauthorized read of restricted resources rather than modification or disruption. |
| Impact | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact and no integrity or availability impact - consistent with CWE-863 Incorrect Authorization enabling forceful browsing to resources that should be access-restricted. No EPSS score was provided in the input, and there is no CISA KEV listing and no public proof-of-concept referenced, so exploitation status is 'no public exploit identified at time of analysis.' This tempers the otherwise alarming 7.5/unauthenticated profile: the raw vector suggests easy remote abuse, but the absence of KEV, POC, or EPSS signal means there is no evidence of real-world or at-scale exploitation yet. The practical risk is further bounded by prevalence - CivicTheme is a niche Drupal design system associated with government/public-sector sites rather than mass-market software - so this reads as a legitimate patch-worthy issue for the specific population that runs CivicTheme, not a broad internet-wide emergency. Note the C:H rating is vendor-assigned; 'forceful browsing' outcomes can range from exposing limited restricted pages to full sensitive-content disclosure, and the terse description does not specify which resources are exposed - verify the concrete impact against the vendor advisory sa-contrib-2025-112. |
| Exploit ScenarioDerived | An unauthenticated remote attacker directly requests a URL or resource managed by the CivicTheme Design System that should be access-controlled, and the incorrect authorization check fails to block the request, returning restricted content. No exploit code is publicly identified; given AV:N/AC:L/PR:N/UI:N the attack is a simple direct HTTP request requiring no special tooling, authentication, or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Unauthenticated, network-reachable attackers can read access-restricted content on Drupal sites running the CivicTheme Design System contributed module at versions from 0.0.0 up to but not including 1.12.0, because the module's authorization logic is incorrect (CWE-863), permitting forceful browsing directly to resources that should be protected. With CVSS 3.1 scored 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), no authentication, user interaction, or non-default configuration is indicated as required, and the impact is confined to confidentiality - unauthorized disclosure of restricted resources rather than modification or denial of service. Exposure is limited to sites that have installed CivicTheme and rely on it to gate access to content; no public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Upgrade the CivicTheme Design System Drupal module to version 1.12.0 or later, which is the vendor-released fix identified in Drupal security advisory SA-CONTRIB-2025-112 (https://www.drupal.org/sa-contrib-2025-112); this is the only complete remediation because the defect is in the module's authorization logic itself. Where an immediate upgrade is not operationally possible, reduce exposure by temporarily disabling or uninstalling the CivicTheme Design System module on sites that use it to protect sensitive content - accepting the trade-off that the site's themed rendering and any dependent components will break - or by adding web-server or reverse-proxy rules that deny direct requests to the specific restricted paths managed by the module, with the caveat that path-based blocking is brittle and may be bypassed if routes or aliases are generated dynamically. Reviewing and tightening Drupal roles/permissions on the affected content, and monitoring logs for direct requests to access-restricted URLs, can serve as interim detective controls but should not be treated as a substitute for applying the 1.12.0 update.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CivicTheme Design System is a Drupal contributed design-system component package maintained under the salsa.digital namespace, as reflected by the CPE string cpe:2.3:a:salsa.digital:civictheme_design_system:*:*:*:*:*:drupal:*:*. The root cause falls under CWE-863 (Incorrect Authorization): the module performs access-control decisions improperly, so an attacker can request a URL or path directly - 'forceful browsing' - and reach a resource whose intended access restrictions are not enforced by the module's own checks. In Drupal, such weaknesses typically arise when a route, controller, template path, or rendered component omits or misapplies the access callback/permission check that the rest of the site relies on, allowing a request to bypass navigation-level gating and retrieve content that should require a specific role or permission. Because the flaw is network-reachable with low complexity and no privileges (PR:N), any reachable instance in the vulnerable range is exposed, while the scoped impact (C:H/I:N/A:N) indicates a read-only confidentiality breach of restricted material.
Know when Civictheme Design System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Forceful browsing is remotely reachable, unauthenticated and low-complexity (AV:N/AC:L/PR:N), yielding unauthorized content disclosure only, so C:H with I:N/A:N.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
DescriptionCVE.org
Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.
Executive ViewAI
Drupal sites running the CivicTheme Design System module below version 1.12.0 can have their access-restricted content read by anyone on the internet, with no login and no user interaction required. This affects only organizations that have installed CivicTheme and rely on it to gate member-only, staff-only, or otherwise restricted pages, but for those sites the confidentiality exposure is direct: restricted material should be treated as potentially readable by the public until the module is updated. Because no public exploit code or confirmed active exploitation was identified at time of analysis, this is a patch-management priority rather than an active-incident response.
Apply vendor patch. Until 1.12.0 or later is deployed on every affected site, additional interim measures include restricting or disabling public exposure of CivicTheme-gated paths at the WAF or reverse-proxy layer, temporarily disabling the module where gated content is highly sensitive and the module is not essential to site function, and reviewing Drupal permissions to confirm which roles and resources actually depend on CivicTheme for authorization.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
GitHub PoC
Exploit-DB