DRUPAL-CONTRIB-2026-303: Composer/drupal/forum_access vulnerability
This module allows forums to be set private and to be given moderators.
The module doesn't sufficiently check access for creating forum topics in private forums. As a result, a user can post new topics in a forum where they should only have view access.
This vulnerability is mitigated by the fact that the vulnerability only exists where the forum field for the forum topic is not using the default select widget, or when content is created through a web services API.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/forum_accessto a version that resolves this vulnerability.Fixed in 2.0.3 - Configuration
Configure the forum field for forum topics to use the default select widget.
Forum topic forum field widget = default select
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects private forums where users are intended to have view-only access, but only when the forum field on forum topics uses a non-default select widget or when topics are created through a web services API.
What does an attacker need to exploit this?
An attacker needs the ability to create a forum topic through an affected non-default forum-field widget or through a web services API. They can then create a topic in a private forum for which they should have only view access.
Are installations using the default forum topic field widget affected?
The vulnerability is mitigated when the forum field for the forum topic uses the default select widget. The described issue exists when a non-default widget is used, or when content is created through a web services API.