{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c1.2.0"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/create_user_permission"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c1.2.0"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/user/509004"
      ],
      "name": "jddh"
    }
  ],
  "details": "This module enables you to have a separate permission only for creating users.\n\nThe module doesn\u0027t respect Drupal\u0027s setting for \"Who can register accounts?\" when set to \"Visitors, but administrator approval is required\".\n\nWhen this option is chosen, the module overrides the setting, and makes it possible to register accounts with no approval.\n\nThis vulnerability can be mitigated by having other settings in place for account registration, such as requiring email verification for new accounts, or permitting account creation for \"Administrators only\".",
  "id": "DRUPAL-CONTRIB-2019-066",
  "modified": "2023-08-11T18:34:46.000Z",
  "published": "2019-09-18T15:07:56.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2019-066"
    }
  ],
  "schema_version": "1.7.0"
}