CVE-2024-21622: Craft CMS Privilege Escalation Flaw

CVE-2024-21622 Overview

Craft CMS contains a privilege escalation vulnerability affecting versions 3.x prior to 3.9.6 and 4.x prior to 4.4.16. The flaw allows authenticated users with certain permission configurations to perform actions beyond their assigned privileges. Craft CMS is a widely deployed content management system used to build custom websites and digital experiences.

The vulnerability is tracked as [CWE-269] Improper Privilege Management. It has been fixed in Craft 4.4.16 and Craft 3.9.6. Craft CMS assigned this issue through GitHub Security Advisory GHSA-j5g9-j7r4-6qvx.

Critical Impact
Authenticated attackers with low-privilege accounts can tamper with element save requests and user parameter submissions to escalate privileges, resulting in unauthorized changes to content and user records.

Affected Products

Craft CMS 3.x prior to 3.9.6
Craft CMS 4.x prior to 4.4.16
Deployments where non-admin users have element edit or user management permissions

Discovery Timeline

2024-01-03 - CVE-2024-21622 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21622

Vulnerability Analysis

The vulnerability stems from insufficient authorization checks in two controllers: ElementsController.php and UsersController.php. In the elements controller, permission checks were performed after applying user-supplied parameters to the element rather than before. A user with limited permissions could tamper with request parameters to modify element attributes they were not authorized to change.

In the users controller, the username field was updated from request body parameters without validating whether the current user had the authority to change usernames on the target account. This allowed any authenticated user submitting the request to override username values on user records they should not control.

The root category of this issue is broken access control combined with mass-assignment style parameter binding, where authorization was decoupled from parameter application.

Root Cause

The root cause is [CWE-269] Improper Privilege Management. The controllers applied POST body parameters to model instances before verifying that the acting user had permission to save the modified element or update the affected user record. Because permission checks ran on the mutated state rather than gating input first, tampered requests could bypass authorization boundaries.

Attack Vector

An authenticated attacker with a low-privilege Craft CMS account sends crafted HTTP requests to element save or user update endpoints. By injecting parameters that would normally be restricted, the attacker triggers privilege escalation against elements or user accounts before the delayed authorization check runs.

php

// Patch: src/controllers/ElementsController.php
        }

        $this->element = $element;
-
-        $this->_applyParamsToElement($element);
        $elementsService = Craft::$app->getElements();
        $user = static::currentUser();

+        // Check save permissions before and after applying POST params to the element
+        // in case the request was tampered with.
+        if (!$elementsService->canSave($element, $user)) {
+            throw new ForbiddenHttpException('User not authorized to save this element.');
+        }
+
+        $this->_applyParamsToElement($element);
+
        if (!$elementsService->canSave($element, $user)) {
            throw new ForbiddenHttpException('User not authorized to save this element.');
        }

Source: CraftCMS Commit 76caf9af

The patch adds a canSave check before parameters are applied to the element, ensuring authorization is enforced on the original state as well as the mutated state.

php

// Patch: src/controllers/UsersController.php
        // Is the site set to use email addresses as usernames?
        if ($generalConfig->useEmailAsUsername) {
            $user->username = $user->email;
-        } else {
+        } elseif ($isNewUser || $currentUser->admin || $isCurrentUser) {
            $user->username = $this->request->getBodyParam('username', ($user->username ?: $user->email));
        }

Source: CraftCMS Commit be81eb65

The user controller patch restricts username changes to new users, administrators, or the account owner.

Detection Methods for CVE-2024-21622

Indicators of Compromise

Unexpected changes to element attributes or user records committed by low-privilege accounts.
HTTP POST requests to Craft CMS element save and user update endpoints containing parameters outside the user's normal editing scope.
Audit log entries showing username modifications by non-admin, non-owner users.
ForbiddenHttpException entries appearing in application logs after upgrading, indicating blocked tampering attempts.

Detection Strategies

Review Craft CMS access logs for repeated POST requests to element and user controller actions from the same low-privilege account.
Correlate user permission levels against the fields modified in save requests to identify anomalous parameter submissions.
Compare current running Craft CMS version against 3.9.6 and 4.4.16 baselines to flag unpatched deployments.

Monitoring Recommendations

Enable verbose logging in Craft CMS to capture full request bodies for element and user endpoints during investigation windows.
Alert on privilege changes, role assignments, and username modifications performed outside of administrator sessions.
Track EPSS scoring and vendor advisories for updates related to Craft CMS security posture.

How to Mitigate CVE-2024-21622

Immediate Actions Required

Upgrade Craft CMS to version 3.9.6 or 4.4.16 or later immediately.
Audit all user accounts and revoke elevated permissions that are not required for daily operations.
Rotate credentials and API tokens for any accounts suspected of tampering activity.
Review recent element and user changes for unauthorized modifications and revert as needed.

Patch Information

Craft CMS released fixes in versions 3.9.6 and 4.4.16. The relevant changes are documented in CraftCMS Pull Request #13931 and CraftCMS Pull Request #13932. Refer to the CraftCMS Changelog 4.5.1 and CraftCMS Changelog 3.9.6 for full release notes.

Workarounds

Restrict user permissions to the minimum required set until patching is complete.
Place the Craft CMS admin panel behind additional network controls such as VPN or IP allowlisting.
Disable non-essential user accounts and temporarily block self-service registration if enabled.

bash

# Upgrade Craft CMS via Composer
composer require craftcms/cms:^4.4.16 --update-with-dependencies
# Or for 3.x branch
composer require craftcms/cms:^3.9.6 --update-with-dependencies

# Apply pending migrations after upgrade
php craft migrate/all --interactive=0
php craft up