Skip to content
OpenAdvisories
Unscored DRUPAL-CONTRIB-2019-048

This module enables you to use special routes for user registration with special roles and custom field sets defined for the role. The modu…

Published May 15, 2019 · Updated Sep 10, 2026 · Assigned by DRUPAL

Description

This module enables you to use special routes for user registration with special roles and custom field sets defined for the role.

The module doesn't sufficiently check which user roles can be registered under the scenario when the user tries to register the user with the administrator role.

This vulnerability is mitigated on sites where account approval is required as the user starts as blocked but still gets the "Administrator" role.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist drupal/multiple_registration < 2.8.0 2.8.0 DRUPAL-CONTRIB-2019-048

References