The Acquia DAM module for Drupal has been identified with a significant security flaw that could lead to unauthorized information access. This vulnerability, tracked as CVE-2025-9954, concerns a missing authorization check within the module.
Essentially, the Acquia DAM module connects your Drupal site to the Acquia Digital Asset Management (DAM) service, helping to sync media files. However, the module doesn’t properly verify if a user has the necessary permissions to view a list of these synced DAM assets. This oversight could allow individuals who shouldn’t have access to potentially browse and view media files from your Acquia DAM service that are stored on the Drupal site. While it specifically affects sites where preventing users with “view media” permission from accessing *any* DAM asset is critical, it’s a serious concern for data privacy and control.
CVE Details
- Product Name: Drupal Acquia DAM
- Published: October 30, 2025
- Severity: HIGH
- Status: Analyzed
Affected Products
This vulnerability impacts the Acquia DAM module for Drupal, specifically all versions from 0.0.0 up to, but not including, version 1.1.5. If you are running an older version of this module, your Drupal site is at risk.
Current Status
The vulnerability has been thoroughly analyzed, and its details are publicly available. This means that while the issue is understood, active steps are required from users to secure their systems.
Severity Level
CVE-2025-9954 is rated as HIGH severity with a CVSS score of 7.5. A high severity rating indicates that the vulnerability has the potential for significant impact. In this case, it could lead to unauthorized individuals gaining access to sensitive digital assets, potentially compromising data confidentiality. It’s crucial for administrators to address this vulnerability promptly to prevent potential information disclosure.
Possible Solutions
The good news is that a fix is available for this issue. To protect your Drupal site, you should:
- Upgrade the Acquia DAM Module: The primary solution is to upgrade your Acquia DAM module for Drupal 8.x to version 1.1.5 or newer. This update includes the necessary authorization validation to prevent the access bypass. Upon upgrading, three specific views will have their access control automatically reset to be permission-based, requiring the “access media overview” permission. If you have custom modifications to these views, you will need to re-apply them after the upgrade.
- Manual Mitigation (If Upgrade Not Possible): If you cannot immediately upgrade to the patched version, you can mitigate the risk by manually modifying three views on your Drupal site: “Acquia DAM Asset Library,” “Acquia DAM links,” and “DAM Content Overview.” These views should be restricted to users who possess the “access media overview” permission.
It is highly recommended to implement the provided solutions without delay to protect your digital assets.
References
https://www.drupal.org/sa-contrib-2025-105
