Some specific contributed or custom code may call Drupal’s user_save() API in a manner different than Drupal core. Depending on the data that has been added to a form or the array prior to saving, this could lead to a user gaining all roles on a site.
This issue is mitigated by the fact that it requires contributed or custom code that calls user_save() with an explicit category and code that loads all roles into the array.
Part of security release SA-CORE-2016-001
This vulnerability affects the following application versions:
- Drupal 6.0
- Drupal 6.1
- Drupal 6.2
- Drupal 6.3
- Drupal 6.4
- Drupal 6.5
- Drupal 6.6
- Drupal 6.7
- Drupal 6.8
- Drupal 6.9