CVE-2025-8996 Layout Builder Advanced Permissions - Moderately critical - Access bypass - SA-CONTRIB-2025-097
Attackers can bypass access controls in the Drupal Layout Builder Advanced Permissions module to view restricted content.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-8996?
CVE-2025-8996 is a medium-severity missing authorization vulnerability in Drupal Layout Builder Advanced Permissions, published on 15 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Missing Authorization vulnerability in Drupal Layout Builder Advanced Permissions allows Forceful Browsing.This issue affects Layout Builder Advanced Permissions: from 0.0.0 before 2.2.0.
Weakness: CWE-862
Which versions are affected by CVE-2025-8996?
It affects 1 product.
Linux distribution packages (1)
drupal/layout_builder_perms Packagist:https://packages.drupal.org/8 | From 2.2.0 to 2.2.0 | None |
Products include Layout Builder Advanced Permissions Project Layout Builder Advanced Permissions.
How do I fix CVE-2025-8996?
No fix has been published for CVE-2025-8996 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-8996 being exploited?
There is no known exploitation of CVE-2025-8996 in the wild and no public exploit code.
Sources
Also known as DRUPAL-CONTRIB-2025-097, GHSA-3wq4-8fhv-h6wv.