CVE-2024-13256
Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020
Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020
Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.
- Record
CVE-2024-13256- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-1220
- Updated
- 2026-11-02
EUVDEUVD-2024-51470
Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.
- Record
EUVD-2024-51470- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xhf8-2ffc-9gh2
Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful...
Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.
- Record
GHSA-xhf8-2ffc-9gh2- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-1220
- Updated
- 2026-11-02
NVD
Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.
- Record
CVE-2024-13256- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-1220
- Updated
- 2026-11-02
OSV
Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020
Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.
- Record
CVE-2024-13256- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-1220
- Updated
- 2026-11-02
OSVDRUPAL-CONTRIB-2024-020 No score
The Email Contact module provides email field display formatters that can display the field as a link to the contact form, or as an inline contact form.
The module does not sufficiently handle restricted entity or field access to the mail sending form, when the "Email contact link" formatter is used.
This vulnerability is mitigated by the fact that it requires the "Email contact link" formatter to be used.
- Record
DRUPAL-CONTRIB-2024-020- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/email_contactPackagist:https://packages.drupal.org/8 |
before 2.0.4 | 2.0.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-13256 is a high vulnerability (CVSS 7.5) in Drupal Email Contact, published May 22, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 36th percentile. Fixed in drupal/email_contact 2.0.4.