Read the docs
TI-2012-05280 Aliases CVE-2012-6562GHSA-wx93-8gv6-wmq3

engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the…

Priority LOW 33CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accounts.

Why it matters now

EPSS 0.01338 71st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:elgg:elgg:*:*:*:*:*:*:*:*up to 1.8.4VulnerableElgg
cpe:2.3:a:elgg:elgg:1.7.0:*:*:*:*:*:*:*1.7.0VulnerableElgg
cpe:2.3:a:elgg:elgg:1.7.1:*:*:*:*:*:*:*1.7.1VulnerableElgg
cpe:2.3:a:elgg:elgg:1.7.2:*:*:*:*:*:*:*1.7.2VulnerableElgg
cpe:2.3:a:elgg:elgg:1.7.3:*:*:*:*:*:*:*1.7.3VulnerableElgg
cpe:2.3:a:elgg:elgg:1.7.4:*:*:*:*:*:*:*1.7.4VulnerableElgg
cpe:2.3:a:elgg:elgg:1.7.5:*:*:*:*:*:*:*1.7.5VulnerableElgg
cpe:2.3:a:elgg:elgg:1.7.6:*:*:*:*:*:*:*1.7.6VulnerableElgg
cpe:2.3:a:elgg:elgg:1.7.7:*:*:*:*:*:*:*1.7.7VulnerableElgg
cpe:2.3:a:elgg:elgg:1.7.8:*:*:*:*:*:*:*1.7.8VulnerableElgg
  • cpe:2.3:a:elgg:elgg:*:*:*:*:*:*:*:* Versions up to 1.8.4 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.7.0:*:*:*:*:*:*:* Versions 1.7.0 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.7.1:*:*:*:*:*:*:* Versions 1.7.1 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.7.2:*:*:*:*:*:*:* Versions 1.7.2 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.7.3:*:*:*:*:*:*:* Versions 1.7.3 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.7.4:*:*:*:*:*:*:* Versions 1.7.4 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.7.5:*:*:*:*:*:*:* Versions 1.7.5 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.7.6:*:*:*:*:*:*:* Versions 1.7.6 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.7.7:*:*:*:*:*:*:* Versions 1.7.7 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.7.8:*:*:*:*:*:*:* Versions 1.7.8 Vulnerable ·Elgg
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:elgg:elgg:1.7.9:*:*:*:*:*:*:*1.7.9VulnerableElgg
cpe:2.3:a:elgg:elgg:1.7.10:*:*:*:*:*:*:*1.7.10VulnerableElgg
cpe:2.3:a:elgg:elgg:1.7.11:*:*:*:*:*:*:*1.7.11VulnerableElgg
cpe:2.3:a:elgg:elgg:1.7.12:*:*:*:*:*:*:*1.7.12VulnerableElgg
cpe:2.3:a:elgg:elgg:1.7.13:*:*:*:*:*:*:*1.7.13VulnerableElgg
cpe:2.3:a:elgg:elgg:1.7.14:*:*:*:*:*:*:*1.7.14VulnerableElgg
cpe:2.3:a:elgg:elgg:1.7.15:*:*:*:*:*:*:*1.7.15VulnerableElgg
cpe:2.3:a:elgg:elgg:1.7.16:*:*:*:*:*:*:*1.7.16VulnerableElgg
cpe:2.3:a:elgg:elgg:1.7.17:*:*:*:*:*:*:*1.7.17VulnerableElgg
cpe:2.3:a:elgg:elgg:1.7.18:*:*:*:*:*:*:*1.7.18VulnerableElgg
cpe:2.3:a:elgg:elgg:1.8.0.1:*:*:*:*:*:*:*1.8.0.1VulnerableElgg
cpe:2.3:a:elgg:elgg:1.8.1:*:*:*:*:*:*:*1.8.1VulnerableElgg
cpe:2.3:a:elgg:elgg:1.8.3:*:*:*:*:*:*:*1.8.3VulnerableElgg
  • cpe:2.3:a:elgg:elgg:1.7.9:*:*:*:*:*:*:* Versions 1.7.9 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.7.10:*:*:*:*:*:*:* Versions 1.7.10 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.7.11:*:*:*:*:*:*:* Versions 1.7.11 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.7.12:*:*:*:*:*:*:* Versions 1.7.12 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.7.13:*:*:*:*:*:*:* Versions 1.7.13 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.7.14:*:*:*:*:*:*:* Versions 1.7.14 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.7.15:*:*:*:*:*:*:* Versions 1.7.15 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.7.16:*:*:*:*:*:*:* Versions 1.7.16 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.7.17:*:*:*:*:*:*:* Versions 1.7.17 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.7.18:*:*:*:*:*:*:* Versions 1.7.18 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.8.0.1:*:*:*:*:*:*:* Versions 1.8.0.1 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.8.1:*:*:*:*:*:*:* Versions 1.8.1 Vulnerable ·Elgg
  • cpe:2.3:a:elgg:elgg:1.8.3:*:*:*:*:*:*:* Versions 1.8.3 Vulnerable ·Elgg

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-6562
  2. 2026-10-03 Alias added: GHSA-wx93-8gv6-wmq3

References

Patch 1

Advisory 1

  • TI-2011-02588 Elgg through 1.7.10 has a SQL injection vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2021-02877 Exposure of Private Personal Information to an Unauthorized Actor in elgg/elgg CVSS 3.1HIGH 7.5
  • TI-2019-08233 Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect. CVSS 3.0MEDIUM 6.1
  • TI-2011-02587 Elgg through 1.7.10 has XSS CVSS 3.1MEDIUM 6.1
  • TI-2021-02861 Authorization Bypass Through User-Controlled Key in elgg/elgg CVSS 3.1MEDIUM 5.9
  • TI-2021-02956 Cross-site Scripting (XSS) - Stored in elgg/elgg CVSS 3.1MEDIUM 5.4
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences