DRUPAL-CONTRIB-2026-303

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/forum_access/DRUPAL-CONTRIB-2026-303.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2026-303
Aliases
  • CVE-2026-122072
Published
2026-11-04T17:34:10Z
Modified
2026-11-04T20:30:02Z
Summary
[none]
Details

This module allows forums to be set private and to be given moderators.

The module doesn't sufficiently check access for creating forum topics in private forums. As a result, a user can post new topics in a forum where they should only have view access.

This vulnerability is mitigated by the fact that the vulnerability only exists where the forum field for the forum topic is not using the default select widget, or when content is created through a web services API.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/forum_access

Package

Name
drupal/forum_access
Purl
pkg:composer/drupal/forum_access?repository_url=https:%2F%2Fpackages.drupal.org%2F8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.0.3
Database specific
Show details 
{
    "constraint": "<2.0.3"
}

Database specific

affected_versions 
"<2.0.3"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/forum_access/DRUPAL-CONTRIB-2026-303.json"