CVE-2009-3782: Unspecified vulnerability in Userpoints 6.x before 6.x-1.1, a module for Drupal, allows remote authenticate...

Security readout for executives and security teams

CVE-2009-3782 is an information disclosure issue in the Drupal Userpoints module. Authenticated users with the “View own userpoints” permission could read userpoint data belonging to other users. Business impact depends on whether that data is sensitive or tied to rewards, reputation, or customer activity. Exposure is likely limited to Drupal deployments using the Userpoints 6.x module before 6.x-1.1, where authenticated accounts have the “View own userpoints” permission enabled. Treat as a targeted cleanup item for legacy Drupal estates. It is not evidenced as actively exploited here, but it can expose user-related rewards or reputation data where affected permissions exist. Mitigation focus: Inventory Drupal sites for the Userpoints module and exact version.; Upgrade Userpoints 6.x versions before 6.x-1.1 per Drupal advisory guidance.; Review who has the “View own userpoints” permission..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.