Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Open Social: Users can see group info they shouldn't by visiting group overview
published 4 years ago
Summary
Open Social, a community management system, has a weakness that allows users to see group information they shouldn't have access to. This happens when they visit the group overview, but not when they access the group directly. Although this issue is limited by certain permissions, it's still a potential security concern, so make sure to update to a supported version if you're still using an affected one.
What to do
- Update drupal drupal/social to version 11.0.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Packagist:https://packages.drupal.org/8 | drupal | drupal/social |
< 11.0.0 Fix: upgrade to 11.0.0
|
Original advisory text
Open Social is a Drupal distribution for online communities.
Group entities created within Open Social did not sufficiently check entity access in group overviews, allowing users to see informatio...
Open Social is a Drupal distribution for online communities.
Group entities created within Open Social did not sufficiently check entity access in group overviews, allowing users to see information in the overviews they should not have access to. Visiting the entity directly resulted in correct access checks applied.
This vulnerability is mitigated by the fact that an attacker must be able to view Group entities in an overview and have certain common permissions revoked.
Please note the affected versions were already unsupported, this advisory is released additionally as there are still reported installs for the affected versions.
Group entities created within Open Social did not sufficiently check entity access in group overviews, allowing users to see information in the overviews they should not have access to. Visiting the entity directly resulted in correct access checks applied.
This vulnerability is mitigated by the fact that an attacker must be able to view Group entities in an overview and have certain common permissions revoked.
Please note the affected versions were already unsupported, this advisory is released additionally as there are still reported installs for the affected versions.
References
Timeline
Published25 May 2022
Updated18 Mar 2026
First seen18 Mar 2026
Sources
DRUPAL-CONTRIB-2022-043 · OSV
Track software like this
Free during beta