This module changes your forum administration page to allow you to set forums private.
Impact
This module changes your forum administration page to allow you to set forums private. You can control what user roles can view, edit, delete, and post to each forum. You can also give each forum a list of users who have administrative access on that forum (AKA moderators). This module requires the ACL module.
Source excerpt · OSVThis module requires the ACL module. This vulnerability is mitigated by the fact that an attacker needs the "administer forums" permission.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 1.0.0Ecosystem versions | 1.0.0 |
Version evidence: OSV · DRUPAL-CONTRIB-2023-035
View original version evidence (0 explicit versions)
Original source description
This module changes your forum administration page to allow you to set forums private. You can control what user roles can view, edit, delete, and post to each forum. You can also give each forum a list of users who have administrative access on that forum (AKA moderators). This module requires the ACL module.
The module processes user input in a way that could be unsafe. This can lead to Remote Code Execution via Object Injection.
This vulnerability is mitigated by the fact that an attacker needs the "administer forums" permission.
This Security Advisory is being released in coordination with SA-CONTRIB-2023-034 for the ACL module, on which Forum Access depends.