View online: https://www.drupal.org/sa-contrib-2025-015
Project: Open Social [1] Date: 2025-February-12 Security risk: *Less critical* 9 ∕ 25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass, Information Disclosure
Affected versions: <12.3.11 || >=12.4.0 <12.4.10 Description: Open Social is a Drupal distribution for online communities, which ships with a default module to invite users to groups and events.
Invites for a specific user can be seen under certain conditions.
The issue is mitigated for events by the fact that social_event_max_enroll has to be enabled.
Solution: Install the latest version:
* If you use Open Social 12.3.x upgrade to Open Social 12.3.11 [3] * If you use Open Social 12.4.x upgrade to Open Social 12.4.10 [4]
Reported By: * Robert Ragas (robertragas) [5] * zanvidmar [6]
Fixed By: * Denis Kolmerschlag (uber_denis) [7] * zanvidmar [8]
Coordinated By: * Greg Knaddison (greggles) [9] of the Drupal Security Team
[1] https://www.drupal.org/project/social [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/social/releases/12.3.11 [4] https://www.drupal.org/project/social/releases/12.4.10 [5] https://www.drupal.org/u/robertragas [6] https://www.drupal.org/u/zanvidmar [7] https://www.drupal.org/u/uber_denis [8] https://www.drupal.org/u/zanvidmar [9] https://www.drupal.org/u/greggles