Drupal Facets
CVE-2025-9549
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Drupal site with Facets enabled
-
ExploitDirectly request restricted facet URLs
-
ImpactDisclose unauthorized filtered content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a Drupal site with the Facets module installed at an affected version (any release before 2.0.10, or 3.0.x before 3.0.1) and the presence of facets or facet-filtered content that is meant to be access-restricted; the attacker directly requests those facet endpoints (forceful browsing) to reach data without proper authorization checks. No authentication is required (PR:N) and no user interaction (UI:N). Limiting factors: the disclosure is confined to whatever information the exposed facets reveal (C:L, not full data access), and sites that do not use Facets to gate restricted content have little practical exposure; impact does not extend to availability. |
| Impact | This is a moderate-severity missing authorization flaw (CWE-862) in the Drupal Facets contributed module. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, score 6.5) indicates a remotely reachable, low-complexity issue requiring no privileges or user interaction - meaning unauthenticated exploitation per PR:N. However, the real-world risk signals temper this: EPSS is only 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit code was identified, so there is no public exploit identified at time of analysis. The impact is bounded - C:L/I:L and A:N - consistent with 'forceful browsing' exposing data/facets a user should not reach rather than full compromise. Net: this is a genuine but low-urgency authorization weakness, not a high-priority emergency. One signal to verify: the vendor rated I:L, yet forceful browsing is typically read-only access-control bypass, which argues for little or no integrity impact (see assessed vector below). Patch availability is confirmed; affected-version boundaries come from NVD/vendor and should drive remediation prioritization over the raw score. |
| Exploit ScenarioDerived | An unauthenticated remote attacker directly requests facet or filtered-search endpoints on a Drupal site running the Facets module, bypassing intended access controls to enumerate or view content/facet values that should be restricted to authorized users. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, special timing, or victim interaction is needed. No public proof-of-concept exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Missing authorization in the Drupal Facets contributed module lets unauthenticated remote attackers bypass access controls and directly request facet endpoints to view content that was intended to be restricted (forceful browsing). All Facets releases before 2.0.10 and 3.0.x releases before 3.0.1 are affected, and the impact is limited to the information those exposed facets reveal rather than full data or system compromise. A vendor patch is available (2.0.10 / 3.0.1), EPSS is low at 0.20% (9th percentile), and no public exploit has been identified at time of analysis.
RemediationAI
Upgrade the Facets module to the vendor-fixed releases: 2.0.10 for the 2.x branch or 3.0.1 for the 3.x branch, as documented in Drupal SA-CONTRIB-2025-099 (https://www.drupal.org/sa-contrib-2025-099). Because the vulnerability is a missing authorization check rather than a code-execution flaw, sites that cannot patch immediately should reduce exposure by disabling or restricting facets that display access-controlled content, removing exposed facet blocks and Views from anonymous-accessible pages, and applying site-wide access controls (for example, requiring authentication to the affected paths or the View results) so that direct requests to facet URLs are denied - noting these are compensating controls that may degrade the faceted-search experience for legitimate users. Reviewing and tightening the content-access permissions on any taxonomy or View results surfaced by facets also helps, and administrators should confirm the site does not rely on Facets alone to gate restricted data.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Facets is a widely deployed contributed Drupal module that provides faceted search and filtering for Views, search API backends, and other listings, generating URLs whose query parameters define the active filters. The flaw is a missing authorization check (CWE-862), which in this context manifests as forceful browsing: because the module does not verify that the requesting user is permitted to access the content behind a given facet path or filter combination, an attacker can enumerate or construct those URLs directly and retrieve listings or data that the site owner meant to gate. The CPE data (cpe:2.3:a:facets_project:facets:*:*:*:*:*:drupal:*:*) confirms this is the Facets project package running on the Drupal platform, not Drupal core itself, so exposure depends on whether the module is installed and whether it is used to expose access-restricted content. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the attack is network-reachable, requires no privileges and no user interaction, while the assessed scope stays at S:U with only low confidentiality impact - a design/authorization gap in the module's routing rather than a memory-safety or injection class defect.
Know when Facets gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Remote, unauthenticated, no interaction (AV:N/AC:L/PR:N/UI:N); forceful browsing is read-only unauthorized access, so C:L with I:N and A:N rather than the vendor's I:L.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
DescriptionCVE.org
Missing Authorization vulnerability in Drupal Facets allows Forceful Browsing.This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Cross-site scripting in the Drupal Facets contributed module allows unauthenticated remote attackers to inject script in
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allo
GitHub PoC
Exploit-DB