Project Ricochet's top notch developers, designers and PM’s allowed us to bring our vision of an e-commerce style class search to life. We had a tight budget and a lot of unexpected problems on the Berkeley side. Utilizing Ricochet's state of the art tracking tools and disciplined scrum approach allowed us to surmount every challenge and end up with a fantastic application. We loved the creative collaboration that allowed us to remake a boring campus class schedule into a high-octane search tool that our students and faculty love! Thank you Casey and the whole PR team!
—Johanna Metzgar

Group control for forums - Critical - Access bypass - SA-CONTRIB-2023-008

Wed, 2023-03-01 09:38 — Anonymous (not verified)

Project: Group control for forumsDate: 2023-March-01Security risk: Critical 15∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Access bypassAffected versions: >=2.0.0 <2.0.2Description: This module enables you to associate Forums as Group 1.x content and use Group access permissions.
Previous versions of the module incorrectly set node access on creation, and did not correctly restrict access to lists of forum topics.Solution: Install the latest version:

If you use the Group control for forums module for Drupal 9.x or 10.x, upgrade to Group control for forums 2.0.2

Reported By:

ekes

Fixed By:

Coordinated By:

Damien McKenna of the Drupal Security Team
Greg Knaddison of the Drupal Security Team

Path to article https://www.drupal.org/sa-contrib-2023-008

Search form

Group control for forums - Critical - Access bypass - SA-CONTRIB-2023-008