CVE-2025-3131: Drupal Eca:event - Condition - Action

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Condition - Action: from 0.0.0 before 1.1.12, from 2.0.0 before 2.0.16, from 2.1.0 before 2.1.7, from 0.0.0 before 1.2.*.

Affected products

• Drupal Eca:event - Condition - Action: before 1.1.12 (fixed in 1.1.12); from 2.0.0, before 2.0.16 (fixed in 2.0.16); from 2.1.0, before 2.1.7 (fixed in 2.1.7)

Published 2025-04-09. Last modified 2026-06-17.