{"id":"DRUPAL-CONTRIB-2025-099","details":"This module enables you to to easily create and manage faceted search interfaces.\n\nThe module doesn't sufficiently check access to entities when they are displayed as facets.\n\nThis vulnerability is mitigated by the fact that only sites that show facets with entity labels (like taxonomy terms) are affected, and only if some of those entities are unpublished or have other access restrictions.\n\n**CVSS risk score ([experimental](https://www.drupal.org/project/securitydrupalorg/issues/3442181)) 6.9 / Medium**\n\n[CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N)","aliases":["CVE-2025-9549"],"modified":"2026-09-10T03:45:43.410770982Z","published":"2025-08-27T17:19:24Z","references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2025-099"}],"affected":[{"package":{"name":"drupal/facets","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/facets?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10"}],"database_specific":{"constraint":"\u003c2.0.10"}},{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.1"}],"database_specific":{"constraint":"\u003e=3.0.0 \u003c3.0.1"}}],"database_specific":{"affected_versions":"\u003c2.0.10 || \u003e=3.0.0 \u003c3.0.1","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/facets/DRUPAL-CONTRIB-2025-099.json"}}],"schema_version":"1.9.0","credits":[{"name":"Damien McKenna (damienmckenna)","contact":["https://www.drupal.org/u/damienmckenna"]}]}