CVE-2024-55634

What it actually does

Inconsistent uniqueness validation for user fields such as email addresses allows duplicate registrations when the underlying database engine or collation does not enforce case- or accent-sensitive matching.

Why it matters to the business

Duplicate user accounts with identical contact information can cause failed password resets, misdirected notifications, billing conflicts, and degraded trust in user data accuracy across Drupal sites.

How an attack unfolds

An attacker identifies a Drupal site, obtains a valid email address already registered on the platform, and submits a new account registration using that same address; the flawed uniqueness check passes because of database collation differences, resulting in two accounts tied to one email.

How to fix it

Upgrade Drupal Core to 10.2.11 or later, 10.3.9 or later, or 11.0.8 or later. Apply the patch commit 3712d59414f556474f990a503c3f7c295f8c719f where direct updates are not feasible. Review database collation settings for user entity tables and enforce consistent case-sensitive uniqueness at the application layer if upgrades are delayed.

How to confirm the fix worked

Confirm the installed Drupal version is at or above the fixed releases; attempt duplicate email registrations in a test environment with the site's production database collation; inspect user entity storage for duplicate email values after the update.

Typical attack path

1. Reconnaissance to locate a Drupal installation and harvest existing user emails via public profiles or leaks
2. Submission of a registration request containing an already-registered email address
3. Bypass of uniqueness enforcement due to database collation mismatch
4. Creation of a second account linked to the same email
5. Subsequent abuse such as account recovery interference or data integrity exploitation

How to detect it

Search user entity storage and registration logs for duplicate email values; review authentication and watchdog logs around the time of account creation for repeated registrations sharing contact fields.

What your security team should do

• Immediately schedule upgrades to the patched Drupal releases listed in fixed_versions
• Audit existing user tables for duplicate email addresses and merge or disable conflicting accounts
• Add application-level uniqueness checks that are collation-independent as a defense-in-depth measure
• Monitor registration and password-reset logs for anomalies indicating duplicate accounts