Every CVE Search/ Get API key

CVE-2024-55634

Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004

8.1 HighFix available

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.41%Up 0.4 points since Dec 10, 2024
90%50%10%1%

What each source reports

CVE List Score used 8.1

Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Record
CVE-2024-55634
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-178, CWE-289
Updated
2026-11-02
EUVDEUVD-2024-3443 8.1

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Record
EUVD-2024-3443
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-7cwc-fjqm-8vh8 6.9

Drupal core Access bypass

Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. As a result, a user may be able to register with the same email address as another user. This may lead to data integrity issues. This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Record
GHSA-7cwc-fjqm-8vh8
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-178
Updated
2026-11-02
GitHub AdvisoriesGHSA-6ccv-8fgf-cjpw No score

Drupal core Denial of Service vulnerability

The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).

Sites that do not use the Comment module are not affected.

Record
GHSA-6ccv-8fgf-cjpw
Updated
2026-11-02
NVD 8.1

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Record
CVE-2024-55634
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-178, CWE-289
Updated
2026-11-02
OSV 8.1

Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Record
CVE-2024-55634
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-178, CWE-289
Updated
2026-11-02
Show 7 moreShow less
OSVGHSA-7cwc-fjqm-8vh8 6.9

Drupal core Access bypass

Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. As a result, a user may be able to register with the same email address as another user. This may lead to data integrity issues. This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Record
GHSA-7cwc-fjqm-8vh8
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-178
Updated
2026-11-02
OSVUBUNTU-CVE-2024-55634 8.1

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Record
UBUNTU-CVE-2024-55634
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVBIT-drupal-2024-55634 No score

Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

Record
BIT-drupal-2024-55634
Updated
2026-11-02
OSVCLSA-2026-1776214337 No score

TuxCare security update for drupal/core (11 CVEs)

TuxCare rebuilt drupal/core to address 11 CVEs. Fixed in 9.5.11-p1+tuxcare.

Record
CLSA-2026-1776214337
Updated
2026-11-02
OSVCLSA-2026-1784682869 No score

TuxCare security update for drupal/core (21 CVEs)

TuxCare rebuilt drupal/core to address 21 CVEs. Fixed in 8.9.20-p1+tuxcare.

Record
CLSA-2026-1784682869
Updated
2026-11-02
OSVDRUPAL-CORE-2024-004 No score

Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation.

As a result, a user may be able to register with the same email address as another user.

This may lead to data integrity issues.

Record
DRUPAL-CORE-2024-004
Updated
2026-11-02
OSVGHSA-6ccv-8fgf-cjpw No score

Drupal core Denial of Service vulnerability

The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).

Sites that do not use the Comment module are not affected.

Record
GHSA-6ccv-8fgf-cjpw
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
drupal/core
Packagist
 8.0.0 up to 10.1.8
10.1.8
drupal/core
Packagist
 10.2.0 up to 10.2.2
10.2.2
drupal/core
Packagist
 8.0.0 up to 10.2.11
10.2.11
drupal/core
Packagist
 10.3.0 up to 10.3.9
10.3.9
drupal/core
Packagist
 11.0.0 up to 11.0.8
11.0.8
drupal/core-recommended
Packagist
 8.0.0 up to 10.2.11
10.2.11
drupal/core-recommended
Packagist
 10.3.0 up to 10.3.9
10.3.9
drupal/core-recommended
Packagist
 11.0.0 up to 11.0.8
11.0.8
drupal/drupal
Packagist
 8.0.0 up to 10.2.11
10.2.11
drupal/drupal
Packagist
 10.3.0 up to 10.3.9
10.3.9
Show 18 moreShow less
Affected packages
PackageAffectedFixed
drupal/drupal
Packagist
 11.0.0 up to 11.0.8
11.0.8
drupal
Bitnami
 8.0.0 up to 10.3.9, 11.0.0 up to 11.0.8
10.3.911.0.8
drupal/core
TuxCare:Packagist
From an advisory covering 10 CVEs
 9.5.11 up to 9.5.11-p1+tuxcare
9.5.11-p1+tuxcare
drupal/core
TuxCare:Packagist
From an advisory covering 20 CVEs
 8.9.20 up to 8.9.20-p1+tuxcare
8.9.20-p1+tuxcare
drupal/core
Packagist
 8.0.0 up to 10.2.11, 10.3.0 up to 10.3.9, 11.0.0 up to 11.0.8, plus listed versions
10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4
Show 45 moreShow less
10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.1.810.2.010.2.0-alpha110.2.0-beta110.2.0-rc110.2.110.2.1010.2.210.2.310.2.410.2.510.2.610.2.710.2.810.2.9
10.2.1110.3.911.0.8
drupal/core
Packagist
 8.0.0 up to 10.1.8, plus listed versions
10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4
Show 45 moreShow less
10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.78.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.4
10.1.8
drupal/core
Packagist
 10.2.0 up to 10.2.2, plus listed versions
10.2.1
10.2.2
drupal/core
Packagist
 8.0.0 up to 10.2.11, plus listed versions
10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4
Show 45 moreShow less
10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.1.810.2.010.2.0-alpha110.2.0-beta110.2.0-rc110.2.110.2.1010.2.210.2.310.2.410.2.510.2.610.2.710.2.810.2.9
10.2.11
drupal/core
Packagist
 10.3.0 up to 10.3.9, plus listed versions
10.3.110.3.210.3.310.3.410.3.510.3.610.3.710.3.8
10.3.9
drupal/core
Packagist
 11.0.0 up to 11.0.8, plus listed versions
11.0.111.0.211.0.311.0.411.0.511.0.611.0.7
11.0.8
drupal/core-recommended
Packagist
 8.0.0 up to 10.2.11, plus listed versions
10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4
Show 45 moreShow less
10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.1.810.2.010.2.0-alpha110.2.0-beta110.2.0-rc110.2.110.2.1010.2.210.2.310.2.410.2.510.2.610.2.710.2.810.2.9
10.2.11
drupal/core-recommended
Packagist
 10.3.0 up to 10.3.9, plus listed versions
10.3.110.3.210.3.310.3.410.3.510.3.610.3.710.3.8
10.3.9
drupal/core-recommended
Packagist
 11.0.0 up to 11.0.8, plus listed versions
11.0.111.0.211.0.311.0.411.0.511.0.611.0.7
11.0.8
drupal/drupal
Packagist
 8.0.0 up to 10.2.11, plus listed versions
10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4
Show 45 moreShow less
10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.1.810.2.010.2.0-alpha110.2.0-beta110.2.0-rc110.2.110.2.1010.2.210.2.310.2.410.2.510.2.610.2.710.2.810.2.9
10.2.11
drupal/drupal
Packagist
 10.3.0 up to 10.3.9, plus listed versions
10.3.110.3.210.3.310.3.410.3.510.3.610.3.710.3.8
10.3.9
drupal/drupal
Packagist
 11.0.0 up to 11.0.8, plus listed versions
11.0.111.0.211.0.311.0.411.0.511.0.611.0.7
11.0.8
drupal7
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
7.23-17.24-17.24-27.26-17.26-1ubuntu0.17.26-1ubuntu0.1+esm17.26-1ubuntu0.1+esm27.26-1ubuntu0.1+esm3
 None known
drupal7
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
7.38-17.41-17.44-1ubuntu1~16.04.07.44-1ubuntu1~16.04.0+esm17.44-1ubuntu1~16.04.0+esm27.44-1ubuntu1~16.04.0+esm3
 None known

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-55634 is a high vulnerability (CVSS 8.1) in Drupal, published February 12, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in drupal/core 10.1.8.

References

Show 9 moreShow less
This page doesn't list everything

Left out here: 1,484 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open