CVE-2025-3474
CVE-2025-3474 · Panels - Critical - Access bypass - SA-CONTRIB-2025-033
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Missing Authentication for Critical Function vulnerability in Drupal Panels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Panels: from 0.0.0 before 4.9.0.
CVSS 6.5 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
panels
- Versions
- ≥ 0.0.0, < 4.9.0: Affected (semver)
Update to 4.9.0
drupal/panels Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: < 4.9.0
Update to 4.9.0