Description
The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | drupal7 | 7.32-1+deb8u7 | DSA-3604-1 |
| Debian 7 | drupal7 | 7.14-2+deb7u14 | DLA-550-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | drupal7 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | drupal7 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/core | >= 7.0, < 7.44 | 7.44 | GHSA-frqf-9qr4-6vxf |
| Packagist | drupal/drupal | >= 7.0, < 7.44 | 7.44 | GHSA-frqf-9qr4-6vxf |
Advisories 2
- DLA-550-1 drupal7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3604-1 drupal7 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-3604 vendor-advisory
- 91230 vdb-entry
- [oss-security] 20160713 CVE requests for Drupal Core - SA-CORE-2016-002 mailing-list
- https://www.drupal.org/SA-CORE-2016-002
- [oss-security] 20160713 Re: CVE requests for Drupal Core - SA-CORE-2016-002 mailing-list