Read Time:1 Minute, 17 Second
Project: 
Drupal core
Date: 
2024-November-20
Security risk: 
Moderately critical 10 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default
Vulnerability: 
Access bypass
Affected versions: 
>= 8.0.0 < 10.2.11 || >= 10.3.0 < 10.3.9 || >= 11.0.0 < 11.0.8
Description: 

Drupal’s uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation.

As a result, a user may be able to register with the same email address as another user.

This may lead to data integrity issues.

Solution: 

Install the latest version:

If you are using Drupal 10.2, update to Drupal 10.2.11.
If you are using Drupal 10.3, update to Drupal 10.3.9.
If you are using Drupal 11.0, update to Drupal 11.0.8.
Drupal 7 is not affected.

All versions of Drupal 10 prior to 10.2 are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)

Updating Drupal will not solve potential issues with existing accounts affected by this bug. See Fixing emails that vary only by case for additional guidance.

Reported By: 
Wayne Eaker
Fixed By: 
Wayne Eaker
cilefen of the Drupal Security Team
Kristiaan Van den Eynde
Drew Webber of the Drupal Security Team
Lee Rowlands of the Drupal Security Team
Coordinated By: 
Juraj Nemec of the Drupal Security Team
Benji Fisher of the Drupal Security Team
xjm of the Drupal Security Team

Read More

More Stories