CVE-2025-48444 Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-064
Attackers can bypass access controls to view restricted content in the Quick Node Block Drupal module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-48444?
CVE-2025-48444 is a medium-severity missing authorization vulnerability in Drupal Quick Node Block, published on 11 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.
Weakness: CWE-862
Which versions are affected by CVE-2025-48444?
2 open source packages ship an affected version, including drupal/quick_node_block. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
drupal/quick_node_block Packagist | All versions | 2.0.0 |
drupal/quick_node_block Packagist | All versions | 2.0.0 |
Linux distribution packages (1)
drupal/quick_node_block Packagist:https://packages.drupal.org/8 | All versions | 2.0.1 |
Products include Quick Node Block Project Quick Node Block.
How do I fix CVE-2025-48444?
Upgrade drupal/quick_node_block to 2.0.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-48444 being exploited?
There is no known exploitation of CVE-2025-48444 in the wild and no public exploit code.
Other vulnerabilities in Drupal Quick Node Block
Sources
Also known as DRUPAL-CONTRIB-2025-064, GHSA-c424-hgg9-9c4w.