Servers and applications
CVE-2017-6924
In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services (rest) module enabled, the comment entity REST resource enabled, and where an attacker can access a user account on the site with…
- Severity
- High 7.4
- Published
- 15 Jan 2019
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 8.3.7
- Exploit chance
- 2.1% in the next 30 daysHigher than 81% of CVEs. EPSS by FIRST, 10 Nov 2026
- Attack
- Over the network · Only under certain conditions · No login needed · No user action needed
- Attacker can
- Read data · Change data
- CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N- Sources
- NVD
Description
In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does not have permission to post approved comments. This issue only affects sites that have the RESTful Web Services (rest) module enabled, the comment entity REST resource enabled, and where an attacker can access a user account on the site with permissions to post comments, or where anonymous users can post comments.
Affected software
| Software | Affected versions |
|---|---|
DrupalServers and applications · cpe:a:drupal:drupal |
|