{"id":"CVE-2024-13309","aliases":["DRUPAL-CONTRIB-2024-073","EUVD-2024-51521","GHSA-p9jg-5w2m-vgg8"],"status":"published","title":"Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073","description":"Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login Disable: from 2.0.0 before 2.1.1.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00263,"percentile":0.18225,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2024-12-11T12:36:29Z","modified":"2026-10-28T02:30:59Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/login_disable","fixed_in":["2.1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/login_disable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.1"}]}]}],"products":[{"vendor":"drupal","product":"login disable"},{"vendor":"login_disable_project","product":"login_disable"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2024-073","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-13309","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p9jg-5w2m-vgg8"},{"url":"https://git.drupalcode.org/project/login_disable","tags":["web"]},{"url":"https://www.drupal.org/project/login_disable","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13309.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-13309","title":"Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073","description":"Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login Disable: from 2.0.0 before 2.1.1.","status":"published","published":"2025-01-09T20:27:35.812Z","modified":"2025-01-30T21:33:50.068Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:34:13.64024Z"}],"euvd":[{"id":"EUVD-2024-51521","description":"Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login Disable: from 2.0.0 before 2.1.1.","status":"published","published":"2025-01-09T20:27:35Z","modified":"2025-01-30T21:33:50Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:08.578338Z"}],"ghsa":[{"id":"GHSA-p9jg-5w2m-vgg8","title":"Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly...","description":"Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login Disable: from 2.0.0 before 2.1.1.","status":"published","published":"2025-01-09T21:31:32Z","modified":"2025-01-31T00:31:46Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:59:43.882222Z"}],"nvd":[{"id":"CVE-2024-13309","description":"Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login Disable: from 2.0.0 before 2.1.1.","status":"published","published":"2025-01-09T21:15:28.74Z","modified":"2026-06-17T07:01:44.953Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:10:42.329342Z"}],"osv":[{"id":"CVE-2024-13309","title":"Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073","description":"Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login Disable: from 2.0.0 before 2.1.1.","status":"published","published":"2025-01-09T20:27:35.812Z","modified":"2026-10-28T02:30:59.321395278Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DRUPAL-CONTRIB-2024-073","description":"This module enables you to prevent existing users from logging in to your Drupal site unless they know the secret key to add to the end of the ?q=user login form page.\n\nThe Login Disable module does not correctly prevent a user with a disabled login from logging in, allowing those users to by-pass the protection offered by the module.\n\nThis vulnerability is mitigated by the fact that an attacker must already have a user account to log in. This bug therefore allows users to log in even if their login is disabled.","status":"published","published":"2024-12-11T12:36:29Z","modified":"2026-09-10T03:46:02.949917911Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}