Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.9

Drupal core lets attackers gain higher privileges

CVE-2024-55634 · published 1 year ago
Summary

Websites using Drupal core versions earlier than 10.2.11, 10.3.9, or 11.0.8 are vulnerable to a flaw that could let an attacker increase their access rights. This could allow a user to perform actions reserved for administrators. Upgrade Drupal core to the latest released version to close the gap.

What to do
  • Update drupal core to version 10.2.11.
  • Update drupal core to version 10.3.9.
  • Update drupal core to version 11.0.8.
  • Update drupal core-recommended to version 10.2.11.
  • Update drupal core-recommended to version 10.3.9.
  • Update drupal core-recommended to version 11.0.8.
  • Update drupal drupal to version 10.2.11.
  • Update drupal drupal to version 10.3.9.
  • Update drupal drupal to version 11.0.8.
  • Update drupal drupal/core to version 11.0.8.
Affected software
Ecosystem VendorProductAffected versions
composer drupal core >= 8.0.0, < 10.2.11
>= 10.3.0, < 10.3.9
>= 11.0.0, < 11.0.8
Fix: upgrade to 10.2.11
composer drupal core-recommended >= 8.0.0, < 10.2.11
>= 10.3.0, < 10.3.9
>= 11.0.0, < 11.0.8
Fix: upgrade to 10.2.11
composer drupal drupal >= 8.0.0, < 10.2.11
>= 10.3.0, < 10.3.9
>= 11.0.0, < 11.0.8
Fix: upgrade to 10.2.11
Packagist drupal drupal/core >= 11.0.0, < 11.0.8
Fix: upgrade to 11.0.8
Original advisory text
Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004
A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
6.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-178Improper Handling of Case Sensitivity
CWE-289Authentication Bypass by Alternate Name
Timeline
Published9 Dec 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-7cwc-fjqm-8vh8 · GHSA
CVE-2024-55634 · NVD
DRUPAL-CORE-2024-004 · OSV
CVE-2024-55634 · OSV
Track software like this
Free during beta