CVE-2025-3474: Drupal Panels

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Missing Authentication for Critical Function vulnerability in Drupal Panels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Panels: from 0.0.0 before 4.9.0.

Affected products

• Drupal Panels: before 4.9 (fixed in 4.9)

Published 2025-04-09. Last modified 2026-06-17.