Description
The LoginToboggan module 7.x-1.x before 7.x-1.4 for Drupal does not properly unset the authorized user role for certain users, which allows remote attackers with the pre-authorized role to gain privileges and possibly obtain sensitive information by accessing a Page Not Found (404) page.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_misc
https://www.drupal.org/node/2300369
Patch, Vendor Advisory x_refsource_confirm
https://www.drupal.org/node/2299467
Scores
EPSS
0.0107
EPSS Percentile
60.7%
Details
CWE
CWE-200
Status
published
Products (5)
logintoboggan_project/logintoboggan
7.x-1.0 (4 CPE variants)
logintoboggan_project/logintoboggan
7.x-1.1
logintoboggan_project/logintoboggan
7.x-1.2
logintoboggan_project/logintoboggan
7.x-1.3
logintoboggan_project/logintoboggan
7.x-1.x x-dev
Published
Dec 10, 2014
Tracked Since
Feb 18, 2026