Vulnerability advisory

CVE-2024-55634

Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004

Published Dec 9, 2024Updated Oct 28, 2026OSV record ↗

Also known as BIT-drupal-2024-55634DRUPAL-CORE-2024-004GHSA-7cwc-fjqm-8vh8

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT git.drupalcode.org/project/drupal ↗
35c2f3ca5c935f3d8bde15932a712677c9bbd50f to before 2570b33d6e36d5835119b683af0d6a866593276b	`2570b33d6e36d5835119b683af0d6a866593276b`
150df8b6d02131a72a34ec1cb5444c191ae5e407 to before f2093af42504324a1f55ca1783eab5b8a93afaa0	`f2093af42504324a1f55ca1783eab5b8a93afaa0`
140f94ff1051644c4416c7ed30cc5dd1f14507b2 to before 3712d59414f556474f990a503c3f7c295f8c719f	`3712d59414f556474f990a503c3f7c295f8c719f`
GIT github.com/drupal/drupal ↗
35c2f3ca5c935f3d8bde15932a712677c9bbd50f to before 2570b33d6e36d5835119b683af0d6a866593276b	`2570b33d6e36d5835119b683af0d6a866593276b`
150df8b6d02131a72a34ec1cb5444c191ae5e407 to before f2093af42504324a1f55ca1783eab5b8a93afaa0	`f2093af42504324a1f55ca1783eab5b8a93afaa0`
140f94ff1051644c4416c7ed30cc5dd1f14507b2 to before 3712d59414f556474f990a503c3f7c295f8c719f	`3712d59414f556474f990a503c3f7c295f8c719f`
Also listed as affected (40) `10.2.10` `10.3.8` `11.0.7` `10.3.7` `11.0.6` `10.2.9` `10.3.6` `11.0.5` `10.3.5` `11.0.4` `10.2.8` `10.3.4` `11.0.3` `10.3.3` `11.0.2` `10.3.2` `11.0.1` `11.0.0` `10.3.1` `10.2.7` `10.3.0-rc1` `10.3.0-beta1` `10.2.6` `10.2.5` `10.2.4` `10.2.3` `10.2.1` `10.2.0` `10.2.0-rc1` `10.2.0-beta1` `10.2.0-alpha1` `10.1.0-alpha1` `10.0.0-alpha5` `10.0.0-alpha4` `10.0.0-alpha3` `10.0.0-alpha1` `9.0.0-alpha2` `9.0.0-alpha1` `8.1.0-beta1` `8.0.0`

Description

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

CVE-2024-55634

Affected versions

Repository

Description

References