Skip to content
Log inStart free trial

GHSA-q3p9-8728-wq7x CVE-2016-3169

Drupal saving user accounts can sometimes grant the user all roles

High Packagist
Severity
8.1 / 10
High · CVSS 3.0
Exploit chance (EPSS)
2.22%
Chance of exploitation in the next 30 days. Higher than 82.68% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-269 Improper Privilege Management
Fix
Available
2 packages have a fixed version

Description

The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function with an explicit category and loads all roles into the array.

Affected versions

Packagist

PackageVulnerableFixed in
drupal/core
>= 6.0, < 6.38
6.38
drupal/core
>= 7.0, < 7.43
7.43
drupal/drupal
>= 7.0, < 7.43
7.43
drupal/drupal
>= 6.0, < 6.38
6.38

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

drupal/core Packagist → 6.38

composer
composer require drupal/core:^6.38

drupal/drupal Packagist → 7.43

composer
composer require drupal/drupal:^7.43

Severity breakdown

CVSS 3.0 8.1

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-269: Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

How to prevent it
  • Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
  • Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system.
  • Architecture and Design: Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
DRUPAL-CORE-2026-004
Drupal Core has a SQL Injection issue
Critical Known exploited Also affects drupal/core
CVE-2020-28949
Multiple vulnerabilities through filename manipulation in Archive_Tar
High Known exploited Also affects drupal/core
CVE-2020-13671
Drupal core Unrestricted Upload of File with Dangerous Type
High Known exploited Also affects drupal/core
CVE-2019-6340
Drupal Core Remote Code Execution Vulnerability
High Known exploited Also affects drupal/core
CVE-2018-7602
Drupal Core Remote Code Execution Vulnerability
Critical Known exploited Also affects drupal/core
CVE-2018-7600
Drupal Core Remote Code Execution Vulnerability
Critical Known exploited Also affects drupal/core
DRUPAL-CORE-2026-016
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.
Not rated yet Also affects drupal/core
DRUPAL-CORE-2026-015
The Drupal core Link module provides a field type that can be used for internal and external URLs.
Not rated yet Also affects drupal/core
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor