{"id":"CVE-2024-13253","aliases":["DRUPAL-CONTRIB-2024-017","EUVD-2024-51467","GHSA-57r5-pmvw-w26w"],"status":"published","title":"Advanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017","description":"Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notifications: from 0.0.0 before 1.5.0.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00386,"percentile":0.33024,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2024-04-24T13:16:40Z","modified":"2026-09-10T03:45:17Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/advanced_pwa","fixed_in":["1.5.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/advanced_pwa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0"}]}]}],"products":[{"vendor":"advanced_pwa_inc_push_notifications_project","product":"advanced_pwa_inc_push_notifications"},{"vendor":"drupal","product":"advanced pwa inc push notifications"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2024-017","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-13253"},{"url":"https://github.com/advisories/GHSA-57r5-pmvw-w26w"}],"sources":{"cve":[{"id":"CVE-2024-13253","title":"Advanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017","description":"Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notifications: from 0.0.0 before 1.5.0.","status":"published","published":"2025-01-09T18:59:22.054Z","modified":"2025-01-10T17:05:28.885Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:34:12.982241Z"}],"euvd":[{"id":"EUVD-2024-51467","description":"Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notifications: from 0.0.0 before 1.5.0.","status":"published","published":"2025-01-09T18:59:22Z","modified":"2025-01-10T17:05:28Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:04:21.63355Z"}],"ghsa":[{"id":"GHSA-57r5-pmvw-w26w","title":"Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows...","description":"Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notifications: from 0.0.0 before 1.5.0.","status":"published","published":"2025-01-09T21:31:30Z","modified":"2025-01-10T18:32:45Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:59:27.888313Z"}],"nvd":[{"id":"CVE-2024-13253","description":"Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notifications: from 0.0.0 before 1.5.0.","status":"published","published":"2025-01-09T19:15:19.317Z","modified":"2026-06-17T07:01:35.69Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:10:41.838321Z"}],"osv":[{"id":"DRUPAL-CONTRIB-2024-017","description":"Progressive web applications are web applications that load like regular web pages or websites but can offer the user functionality such as working offline, push notifications, and device hardware access traditionally available only to native applications.\n\nThis module doesn't sufficiently protect access to the settings form, allowing an unauthorized malicious user to view and modify the module settings.","status":"published","published":"2024-04-24T13:16:40Z","modified":"2026-09-10T03:45:17.791893594Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}