{"id":"CVE-2024-22513","aliases":["GHSA-5vcc-86wm-547q","PYSEC-2026-1305"],"title":"Improper Privilege Management in djangorestframework-simplejwt","summary":"Improper Privilege Management in djangorestframework-simplejwt","severity":"low","vendor":"djangorestframework-simplejwt","product":"djangorestframework-simplejwt","ecosystem":"pip","affected":["djangorestframework-simplejwt < 5.5.1"],"patched":["djangorestframework-simplejwt 5.5.1"],"published":"2024-03-16","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-5vcc-86wm-547q","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22513"},{"url":"https://github.com/jazzband/djangorestframework-simplejwt/issues/779"},{"url":"https://github.com/jazzband/djangorestframework-simplejwt/pull/872"},{"url":"https://github.com/jazzband/djangorestframework-simplejwt/pull/873"},{"url":"https://github.com/jazzband/djangorestframework-simplejwt/pull/891"},{"url":"https://github.com/jazzband/djangorestframework-simplejwt/commit/14e8b2cf5fa0df954af82ff3926fa6d6c4ecf13e"},{"url":"https://github.com/jazzband/djangorestframework-simplejwt/commit/1ad763bfe73936515aa4756263338c63866364c9"},{"url":"https://github.com/jazzband/djangorestframework-simplejwt/commit/a2d0a0201b6123536ecf76cd4d0ec7389317d0a7"},{"url":"https://github.com/dmdhrumilmistry/CVEs/tree/main/CVE-2024-22513"},{"url":"https://github.com/jazzband/djangorestframework-simplejwt"},{"url":"https://github.com/jazzband/djangorestframework-simplejwt/blob/c791e987332ed5e22a86428160d6372b1d85ffae/rest_framework_simplejwt/tokens.py#L281"}],"tags":["osv","pip","exploit-available"],"epss":0.00804,"epssPercentile":0.54825,"exploitAvailable":true,"ingestedAt":"2026-07-08T18:25:46.210Z","exploits":{"exploitdb":true,"checkedAt":"2026-09-25T08:20:42.852Z"},"slug":"CVE-2024-22513","body":"## Overview\n\ndjangorestframework-simplejwt before version 5.5.1 is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method.\n\n## Affected packages\n\n- `djangorestframework-simplejwt < 5.5.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `djangorestframework-simplejwt 5.5.1`","depth":"twilight","depthScore":26,"depthScoreParts":{"impact":13.8,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[]}