Every CVE Search/ Get API key

CVE-2024-21622

Craft CMS Privilege Escalation

5.4 MediumFix available

Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.59%Up 0.5 points since Jan 18, 2024
90%50%10%1%

What each source reports

CVE List Score used 5.4

Craft CMS Privilege Escalation

Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.

Record
CVE-2024-21622
CVSS 3.1
5.4 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Weakness
CWE-269
Updated
2026-11-02
EUVDEUVD-2024-0374 5.4

Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.

Record
EUVD-2024-0374
CVSS 3.1
5.4 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-j5g9-j7r4-6qvx 5.4

Craft CMS Privilege Escalation

Impact

This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft with certain user permissions setups.

Patches

This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.

References

https://github.com/craftcms/cms/pull/13932 https://github.com/craftcms/cms/pull/13931 https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16

Record
GHSA-j5g9-j7r4-6qvx
CVSS 3.1
5.4 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Weakness
CWE-269
Updated
2026-11-02
NVD 5.4

Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.

Record
CVE-2024-21622
CVSS 3.1
5.4 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-269
Updated
2026-11-02
OSV 5.4

Craft CMS Privilege Escalation

Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.

Record
CVE-2024-21622
CVSS 3.1
5.4 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Weakness
CWE-269
Updated
2026-11-02
OSVGHSA-j5g9-j7r4-6qvx 5.4

Craft CMS Privilege Escalation

Impact

This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft with certain user permissions setups.

Patches

This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.

References

https://github.com/craftcms/cms/pull/13932 https://github.com/craftcms/cms/pull/13931 https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16

Record
GHSA-j5g9-j7r4-6qvx
CVSS 3.1
5.4 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Weakness
CWE-269
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
craftcms/cms
Packagist
 4.0.0-RC1 to 4.5.10
4.5.11
craftcms/cms
Packagist
 3.0.0 to 3.9.5
3.9.6
craftcms/cms
Packagist
 4.0.0-RC1 up to 4.5.11, plus listed versions
4.0.04.0.0-RC24.0.0-RC34.0.0.14.0.1
Show 45 moreShow less
4.0.24.0.34.0.44.0.54.0.5.14.0.5.24.0.64.1.04.1.0.14.1.0.24.1.14.1.24.1.34.1.44.1.4.14.2.04.2.0.14.2.0.24.2.14.2.1.14.2.24.2.34.2.44.2.54.2.5.14.2.5.24.2.64.2.74.2.84.3.04.3.14.3.104.3.114.3.24.3.2.14.3.34.3.44.3.54.3.64.3.6.14.3.74.3.7.14.3.84.3.8.14.3.8.2
4.5.11
craftcms/cms
Packagist
 3.0.0 up to 3.9.6, plus listed versions
3.0.0.13.0.0.23.0.13.0.103.0.10.1
Show 45 moreShow less
3.0.10.23.0.10.33.0.113.0.123.0.133.0.13.13.0.13.23.0.143.0.153.0.163.0.16.13.0.173.0.17.13.0.183.0.193.0.23.0.203.0.213.0.223.0.233.0.23.13.0.243.0.253.0.263.0.26.13.0.273.0.27.13.0.283.0.293.0.33.0.3.13.0.303.0.30.13.0.30.23.0.313.0.323.0.333.0.343.0.353.0.363.0.373.0.383.0.393.0.43.0.40
3.9.6

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-21622 is a medium vulnerability (CVSS 5.4) in Craftcms Cms, published January 3, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in craftcms/cms 4.5.11.

References

Show 5 moreShow less
This page doesn't list everything

Left out here: 423 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open