drupal-contrib-2026-303

{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "<2.0.3",
        "source": "https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/forum_access/DRUPAL-CONTRIB-2026-303.json"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/forum_access",
        "purl": "pkg:composer/drupal/forum_access?repository_url=https:%2F%2Fpackages.drupal.org%2F8"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "<2.0.3"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-122072"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/nicob"
      ],
      "name": "nico.b"
    }
  ],
  "details": "This module allows forums to be set private and to be given moderators.\n\nThe module doesn't sufficiently check access for creating forum topics in private forums. As a result, a user can post new topics in a forum where they should only have view access.\n\nThis vulnerability is mitigated by the fact that the vulnerability only exists where the forum field for the forum topic is not using the default select widget, or when content is created through a web services API.",
  "id": "DRUPAL-CONTRIB-2026-303",
  "modified": "2026-11-04T20:30:02.731596771Z",
  "published": "2026-11-04T17:34:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-303"
    }
  ],
  "schema_version": "1.9.2"
}