CVE-2025-13985 - Entity Share - Moderately critical - Access bypass, Information Disclosure

Back Back to CVE browser

MEDIUM

Entity Share - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-123

Published Jan 28, 2026

5.3

MEDIUM

CVSS 3.1

EPSS 0.22%

Description

Incorrect Authorization vulnerability in Drupal Entity Share allows Forceful Browsing.This issue affects Entity Share: from 0.0.0 before 3.13.0.

Affected products

Vendor Drupal Product Entity Share Default
unaffected
- Version
  0.0.0
  Status
  affected
  Constraints
  <3.13.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Drupal

Entity Share

unaffected

Version	Status	Constraints
0.0.0	affected	<3.13.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-206436
Advisory
https://www.drupal.org/sa-contrib-2025-123
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-206436		Advisory
https://www.drupal.org/sa-contrib-2025-123		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner drupal

Published Jan 28, 2026

Updated Jan 29, 2026

Reserved Dec 3, 2025

Link CVE-2025-13985

CISA Vulnrichment

Updated Jan 29, 2026

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-13985

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-13985

ENISA EUVD

Assigner drupal

Published Jan 28, 2026

Updated Jan 29, 2026

Exploited since n/a

Link EUVD-2025-206436

EUVD-2025-206436