CVE-2024-22513

Improper Privilege Management in djangorestframework-simplejwt

5.5 MediumPublic exploitFix available

djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.80%Up 0.7 points since Mar 16, 2024

What each source reports

CVE List Score used 5.5

Record: CVE-2024-22513
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-306
Updated: 2026-11-02

EUVDEUVD-2024-0836 5.5

Record: EUVD-2024-0836
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5vcc-86wm-547q No score

Improper Privilege Management in djangorestframework-simplejwt

djangorestframework-simplejwt before version 5.5.1 is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method.

Record: GHSA-5vcc-86wm-547q
Weakness: CWE-269
Updated: 2026-11-02

NVD 5.5

Record: CVE-2024-22513
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-306
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-22513 5.5

Record: DEBIAN-CVE-2024-22513
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-22513 5.5

Record: UBUNTU-CVE-2024-22513
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Show 4 moreShow less

OSV No score

Record: CVE-2024-22513
Updated: 2026-11-02

OSVGHSA-5vcc-86wm-547q No score

Improper Privilege Management in djangorestframework-simplejwt

Record: GHSA-5vcc-86wm-547q
Weakness: CWE-269
Updated: 2026-11-02

OSVopenSUSE-SU-2025:15699-1 No score

python311-djangorestframework-simplejwt-5.5.1-1.1 on GA media

These are all security issues fixed in the python311-djangorestframework-simplejwt-5.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:15699-1
Updated: 2026-11-02

OSVPYSEC-2026-1305 No score

Improper Privilege Management in djangorestframework-simplejwt

Record: PYSEC-2026-1305
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`djangorestframework-simplejwt` PyPI	before 5.5.1	5.5.1
`python-djangorestframework-simplejwt` Debian:12	All versions, plus listed versions 5.2.2-15.3.0-15.3.1-15.3.1-25.4.0-1 Show 4 moreShow less 5.5.0-15.5.1-15.5.1-25.5.1-3	None known
`python-djangorestframework-simplejwt` Debian:13	All versions, plus listed versions 5.5.0-15.5.1-15.5.1-25.5.1-3	None known
`python-djangorestframework-simplejwt` Debian:14	All versions, plus listed versions 5.5.0-15.5.1-15.5.1-25.5.1-3	None known
`djangorestframework-simplejwt` PyPI	before 5.5.1, plus listed versions 1.01.11.21.2.11.3 Show 42 moreShow less 1.41.51.5.12.0.02.0.12.0.22.0.32.0.42.0.52.13.03.13.23.2.13.2.23.2.33.34.0.04.1.04.1.14.1.24.1.34.1.44.1.54.2.04.3.04.4.04.5.04.6.04.7.04.7.14.7.24.8.05.0.05.1.05.2.05.2.15.2.25.3.05.3.15.4.05.5.0	5.5.1
`python-djangorestframework-simplejwt` Ubuntu:22.04:LTS	All versions, plus listed versions 5.0.0-1	None known
`python-djangorestframework-simplejwt` Ubuntu:24.04:LTS	All versions, plus listed versions 5.2.2-15.3.0-15.3.1-1	None known
`python-djangorestframework-simplejwt` Ubuntu:25.10	All versions, plus listed versions 5.4.0-15.5.0-1	None known
`python-djangorestframework-simplejwt` Ubuntu:26.10	All versions, plus listed versions 5.5.1-15.5.1-2	None known
`python-djangorestframework-simplejwt` Ubuntu:26.04:LTS	All versions, plus listed versions 5.5.0-15.5.1-1	None known
`python-djangorestframework-simplejwt` openSUSE:Tumbleweed	before 5.5.1-1.1	5.5.1-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	djangorestframework-simplejwt 5.3.1 - Information Disclosure	2024-04-15

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-22513 is a medium vulnerability (CVSS 5.5) in djangorestframework-simplejwt, published March 16, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 56th percentile. Fixed in djangorestframework-simplejwt 5.5.1.

References

Show 11 moreShow less