CVE-2024-13248
Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012
Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012
Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0.
- Record
CVE-2024-13248- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-266
- Updated
- 2026-11-02
EUVDEUVD-2024-51462
Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0.
- Record
EUVD-2024-51462- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2479-2frf-9263
Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence...
Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0.
- Record
GHSA-2479-2frf-9263- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-266
- Updated
- 2026-11-02
NVD
Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0.
- Record
CVE-2024-13248- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-266
- Updated
- 2026-11-02
OSVDRUPAL-CONTRIB-2024-012No score
This module gives each node a 'private' checkbox. If it's set, the node can only be seen by the node author, or users with the 'access private content' permission.
The module incorrectly grants access to private nodes under certain specific circumstances. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Access private content".
- Record
DRUPAL-CONTRIB-2024-012- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/private_contentPackagist:https://packages.drupal.org/8 | before 2.1.0 | 2.1.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-13248 is a medium vulnerability (CVSS 5.5) in Drupal Private Content, published February 28, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in drupal/private_content 2.1.0.