CVE-2024-13251

CVE-2024-13251 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Drupal Registration role module that allows privilege escalation. The issue affects the Registration role module from version 0.0.0 before 2.0.1. Published on January 9, 2025, it has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

An authenticated attacker with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation enables privilege escalation, granting high-level access that compromises confidentiality, integrity, and availability of the affected Drupal instance.

The Drupal security advisory SA-CONTRIB-2024-015 details the vulnerability and mitigation steps, available at https://www.drupal.org/sa-contrib-2024-015. Administrators should upgrade the Registration role module to version 2.0.1 or later to remediate the issue.