CVE-2016-6211: Debian Linux

High severity, CVSS 8.8. EPSS: 2.8% chance of exploitation in the next 30 days.

The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form.

Affected products

• Debian Debian Linux: version 8.0 only
• Drupal Drupal: version 7.0 only; version 7.1 only; version 7.2 only; version 7.3 only; version 7.4 only; version 7.5 only; …

Published 2016-09-09. Last modified 2026-06-17.