{"id":"CVE-2024-13256","aliases":["DRUPAL-CONTRIB-2024-020","EUVD-2024-51470","GHSA-xhf8-2ffc-9gh2"],"status":"published","title":"Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020","description":"Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00415,"percentile":0.36309,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1220"],"published":"2024-05-22T16:03:46Z","modified":"2026-10-28T02:30:27Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/email_contact","fixed_in":["2.0.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/email_contact","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4"}]}]}],"products":[{"vendor":"drupal","product":"email contact"},{"vendor":"email_contact_project","product":"email_contact"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2024-020","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-13256","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xhf8-2ffc-9gh2"},{"url":"https://git.drupalcode.org/project/email_contact","tags":["web"]},{"url":"https://www.drupal.org/project/email_contact","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13256.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-13256","title":"Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020","description":"Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.","status":"published","published":"2025-01-09T19:03:47.618Z","modified":"2025-01-10T17:00:06.49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-1220"],"updated_at":"2026-11-02T14:34:13.321108Z"}],"euvd":[{"id":"EUVD-2024-51470","description":"Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.","status":"published","published":"2025-01-09T19:03:47Z","modified":"2025-01-10T17:00:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:04:21.63355Z"}],"ghsa":[{"id":"GHSA-xhf8-2ffc-9gh2","title":"Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful...","description":"Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.","status":"published","published":"2025-01-09T21:31:30Z","modified":"2025-01-10T18:32:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-1220"],"updated_at":"2026-11-02T14:59:27.888313Z"}],"nvd":[{"id":"CVE-2024-13256","description":"Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.","status":"published","published":"2025-01-09T19:15:19.66Z","modified":"2026-06-17T07:01:36.17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-1220"],"updated_at":"2026-11-02T14:10:41.838321Z"}],"osv":[{"id":"CVE-2024-13256","title":"Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020","description":"Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.","status":"published","published":"2025-01-09T19:03:47.618Z","modified":"2026-10-28T02:30:27.368921485Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-1220"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DRUPAL-CONTRIB-2024-020","description":"The Email Contact module provides email field display formatters that can display the field as a link to the contact form, or as an inline contact form.\n\nThe module does not sufficiently handle restricted entity or field access to the mail sending form, when the \"Email contact link\" formatter is used.\n\nThis vulnerability is mitigated by the fact that it requires the \"Email contact link\" formatter to be used.","status":"published","published":"2024-05-22T16:03:46Z","modified":"2026-09-10T03:45:38.991792902Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}