CVE-2025-3474: Drupal Panels Auth Bypass Vulnerability

CVE-2025-3474 Overview

CVE-2025-3474 is a missing authentication vulnerability in the Drupal Panels contributed module. The flaw enables attackers to exploit incorrectly configured access control security levels on panel pages. Panels versions prior to 4.9.0 are affected. Because the module does not enforce authentication on a critical function, unauthenticated network requests can reach content or actions that should require authorization. The issue is categorized as [CWE-306: Missing Authentication for Critical Function]. Drupal published guidance in advisory SA-CONTRIB-2025-033 and released version 4.9.0 to remediate the flaw.

Critical Impact
Unauthenticated remote attackers can access panel resources protected by misconfigured access controls, resulting in limited confidentiality and integrity impact on affected Drupal sites.

Affected Products

Drupal Panels module versions 0.0.0 through 4.8.x
Drupal sites running the Panels contributed module below 4.9.0
Any Drupal deployment relying on Panels access control security levels for content protection

Discovery Timeline

2025-04-09 - CVE-2025-3474 published to NVD alongside Drupal advisory SA-CONTRIB-2025-033
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3474

Vulnerability Analysis

The Panels module extends Drupal's page rendering pipeline to let site builders assemble layouts from discrete panes. Each pane can have access control security levels applied to restrict who views its content. The vulnerability arises because the module fails to enforce authentication on a critical code path that evaluates these access rules. When the check is skipped or misapplied, requests from unauthenticated users are treated as if they had passed access control. Attackers can reach resources whose visibility depends on Panels' security level configuration without providing credentials.

Root Cause

The root cause is missing authentication enforcement on a critical function within the Panels module, tracked as [CWE-306]. Access control security levels rely on the module to verify a caller's authentication state before granting access. In versions before 4.9.0, that check is absent or bypassable through direct request paths. The result is a broken access control primitive where configuration alone cannot protect content on affected sites.

Attack Vector

Exploitation requires only network access to the Drupal site. An attacker sends crafted HTTP requests to panel routes that host content restricted through Panels' access control security levels. No user interaction and no prior privileges are required. Successful exploitation exposes information from restricted panes and may allow limited modifications where the exposed function permits state changes. See the Drupal Security Advisory for module-specific request paths and remediation guidance.

Detection Methods for CVE-2025-3474

Indicators of Compromise

Unauthenticated HTTP requests targeting /panels/, /node/*/panels, and other Panels-managed routes returning 200 OK for restricted content
Access logs showing anonymous sessions retrieving panes configured with access control security levels
Unexpected increases in traffic to panel pages from single IP addresses or automated scanners

Detection Strategies

Audit the installed Panels module version using drush pm:list --type=module and compare against 4.9.0
Review Drupal watchdog and web server logs for access to panel URLs by anonymous users where the content should be gated
Correlate anonymous access events with sensitive panel configurations to identify potential unauthorized data exposure

Monitoring Recommendations

Enable verbose logging on the Panels module and forward Drupal logs to a centralized SIEM for correlation
Alert on repeated anonymous requests to panel routes tied to internal, staff, or role-restricted content
Track HTTP 4xx to 2xx transitions on Panels endpoints, which may indicate bypass attempts succeeding after the vulnerability is triggered

How to Mitigate CVE-2025-3474

Immediate Actions Required

Upgrade the Drupal Panels module to version 4.9.0 or later on all affected sites
Review Panels access control security level configurations after upgrading to confirm expected enforcement
Rotate any credentials or tokens that may have been exposed through restricted panes during the vulnerable window

Patch Information

Drupal fixed the vulnerability in Panels 4.9.0. Details are available in the Drupal Security Advisory SA-CONTRIB-2025-033. Site administrators should apply the update through Composer or the standard Drupal update workflow and clear caches after deployment.

Workarounds

Restrict access to panel routes at the web server or reverse proxy layer until the module is upgraded
Temporarily disable panes that expose sensitive content through access control security levels
Enforce authentication for the entire site through Drupal configuration where public access is not required

bash

# Configuration example: upgrade Panels via Composer and clear caches
composer update drupal/panels --with-dependencies
vendor/bin/drush updatedb -y
vendor/bin/drush cache:rebuild
vendor/bin/drush pm:list --type=module --status=enabled | grep panels