[IT-SecNots] [Security-news] Forum Access - Moderately critical - Access bypass - SA-CONTRIB-2026-303

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-303

Project: Forum Access [1]
Project machine name: forum_access
Date: 2026-November-04
Security risk: *Moderately critical* 10 ∕ 25
AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Access bypass

Affected versions: <2.0.3
CVE IDs: CVE-2026-122072
Description: 
This module allows forums to be set private and to be given moderators.

The module doesn't sufficiently check access for creating forum topics in
private forums. As a result, a user can post new topics in a forum where they
should only have view access.

This vulnerability is mitigated by the fact that the vulnerability only
exists where the forum field for the forum topic is not using the default
select widget, or when content is created through a web services API.

Solution: 
Install the latest version:

 * Upgrade to Forum Access 2.0.3 [3].

Reported By: 
 * nico.b [4]

Fixed By: 
 * Mikhail Khasaya (dillix) [5]
 * Kurucz István (nevergone) [6]
 * nico.b [7]
 * Hans Salvisberg (salvis) [8]

Coordinated By: 
 * Swan Kalata (akalata) [9] of the Drupal Security Team
 * Bram Driesen (bramdriesen) [10] of the Drupal Security Team
 * Damien McKenna (damienmckenna) [11] of the Drupal Security Team
 * Lee Rowlands (larowlan) [12] of the Drupal Security Team
 * Juraj Nemec (poker10) [13] of the Drupal Security Team
 * Jess  (xjm) [14] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [15]

[1] https://www.drupal.org/project/forum_access
[2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined
[3] https://www.drupal.org/project/forum_access/releases/2.0.3
[4] https://www.drupal.org/u/nicob
[5] https://www.drupal.org/u/dillix
[6] https://www.drupal.org/u/nevergone
[7] https://www.drupal.org/u/nicob
[8] https://www.drupal.org/u/salvis
[9] https://www.drupal.org/u/akalata
[10] https://www.drupal.org/u/bramdriesen
[11] https://www.drupal.org/u/damienmckenna
[12] https://www.drupal.org/u/larowlan
[13] https://www.drupal.org/u/poker10
[14] https://www.drupal.org/u/xjm
[15]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3630810

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at