DRUPAL-CONTRIB-2019-048
This module enables you to use special routes for user registration with special roles and custom field sets defined for the role.
The module doesn't sufficiently check which user roles can be registered under the scenario when the user tries to register the user with the administrator role.
This vulnerability is mitigated on sites where account approval is required as the user starts as blocked but still gets the "Administrator" role.
What each source reports
OSV No score
This module enables you to use special routes for user registration with special roles and custom field sets defined for the role.
The module doesn't sufficiently check which user roles can be registered under the scenario when the user tries to register the user with the administrator role.
This vulnerability is mitigated on sites where account approval is required as the user starts as blocked but still gets the "Administrator" role.
- Record
DRUPAL-CONTRIB-2019-048- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/multiple_registrationPackagist:https://packages.drupal.org/8 |
before 2.8.0 | 2.8.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2019-048 is a vulnerability with no CVSS score yet in drupal/multiple_registration, published May 15, 2019. No source lists public exploit code. Fixed in drupal/multiple_registration 2.8.0.