{"cve":"CVE-2024-21622","nvd":{"published":"2024-01-03T17:15:12.330","modified":"2026-06-17T07:09:51.850","status":"Modified","description":"Craft is a content management system. This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft starting in 3.x prior to 3.9.6 and 4.x prior to 4.4.16 with certain user permissions setups. This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-269"],"references":["https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16","https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16","https://github.com/craftcms/cms/commit/76caf9af07d9964be0fd362772223be6a5f5b6aa","https://github.com/craftcms/cms/commit/be81eb653d633833f2ab22510794abb6bb9c0843","https://github.com/craftcms/cms/pull/13931"],"products":["craftcms:craft_cms"],"source":"nvd","synced_at":"2026-10-19T21:43:38.875533635+00:00"},"epss":{"cve":"CVE-2024-21622","score":0.00588,"percentile":0.4813,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}