What is the CVSS score of CVE-2024-21622?

CVE-2024-21622 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Craft Cms are affected by CVE-2024-21622?

Organizations using Craft starting in 3.x should be aware of moderate risk from CVE-2024-21622, a improper privilege management vulnerability rated CVSS 5.4.. A patch is available.

How to fix or mitigate CVE-2024-21622?

Within 30 days: Identify affected systems running Craft starting in 3.x and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Craft Cms CVE-2024-21622

MEDIUM

Improper Privilege Management (CWE-269)

2024-01-03 security-advisories@github.com

Privilege Escalation Craft Cms

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:33 vuln.today

Patch released

Mar 28, 2026 - 19:33 nvd

Patch available

CVE Published

Jan 03, 2024 - 17:15 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.

AnalysisAI

Craft is a content management system. Rated medium severity (CVSS 5.4), this vulnerability is low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.

Technical ContextAI

This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions. Affected products include: Craftcms Craft Cms. Version information: prior to 3.9.6.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply principle of least privilege, validate privilege transitions, implement proper role separation.