Project: 
General Data Protection Regulation
Date: 
2025-February-26
Security risk: 
Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All
Vulnerability: 
Cross Site Request Forgery
Affected versions: 
<3.0.1 || >=3.1.0 <3.1.2
CVE IDs: 
CVE-2025-31689
Description: 

The GDPR Task submodule enables you to create GDPR tasks.

The module doesn't sufficiently protect against Cross Site Request Forgery (CSRF) attacks by validating user identity and intent when creating tasks.

Solution: 

Install the latest version:

  • If you use the General Data Protection Regulation module 3.0.x, upgrade to 3.0.1
  • If you use the General Data Protection Regulation module 3.1.x, upgrade to 3.1.2
Reported By: 
Fixed By: 
Coordinated By: