CVE-2026-122072: Composer/drupal/forum_access vulnerability
This module allows forums to be set private and to be given moderators.
The module doesn't sufficiently check access for creating forum topics in private forums. As a result, a user can post new topics in a forum where they should only have view access.
This vulnerability is mitigated by the fact that the vulnerability only exists where the forum field for the forum topic is not using the default select widget, or when content is created through a web services API.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/forum_accessto a version that resolves this vulnerability.Fixed in 2.0.3 - Configuration
Configure the forum field for forum topics to use the default select widget.
Forum topic forum field widget = default select widget
Event History
Frequently Asked Questions
Are sites using the default forum-topic field widget affected?
The issue is mitigated when the forum field for forum topics uses the default select widget. Exposure exists when that field uses a non-default widget or when topics are created through a web services API.
What access would an attacker need to exploit this?
The attacker must be able to create a forum topic through an affected creation path. They can then post in a private forum where their intended permission is view-only access.
How can I identify potentially affected configurations?
Review the widget configured for the forum field on forum-topic content and identify any non-default widget. Also review whether forum topics can be created through a web services API.