SA-CONTRIB-2026-303: Critical severity composer/drupal/forum_access vulnerability
This module allows forums to be set private and to be given moderators. The module doesn't sufficiently check access for creating forum topics in private forums. As a result, a user can post new topics in a forum where they should only have view access. This vulnerability is mitigated by the fact that the vulnerability only exists where the forum field for the forum topic is not using the default select widget, or when content is created through a web services API.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/forum_accessto a version that resolves this vulnerability.Fixed in 2.0.3 - Configuration
Configure the forum field for forum topics to use the default select widget.
Forum topic creation forum field widget = default select widget
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites are affected where the forum field on forum topics uses a non-default widget, or where forum topic content can be created through a web services API. The default select widget mitigates the issue for topic creation through the standard form.
What access does an attacker need to exploit it?
The attacker must be able to create forum topics. They can then create a topic in a private forum for which they should have view-only access.
Are private forums with the default topic-creation widget affected?
The vulnerability is mitigated when the forum field uses the default select widget. This mitigation does not apply to topic creation through a web services API.