-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| drupal/core | composer | >= 7.0, < 7.44 | 7.44 |
| drupal/drupal | composer | >= 7.0, < 7.44 | 7.44 |
Miggo AIRoot Cause AnalysisThe vulnerability arises when a form rebuild (e.g., via drupal_rebuild_form) retains role selection fields in the user profile form despite lacking proper permission re-checks. The user_profile_form function is responsible for adding role fields conditionally. If a rebuild bypasses the 'administer permissions' check (e.g., due to stale $form_state data), attackers can submit role changes. The fix in Drupal 7.44 enforced permission checks during rebuilds, confirming this function's central role in the vulnerability.