View online: https://www.drupal.org/sa-contrib-2022-061

Project: Open Social [1] Date: 2022-November-30 Security risk: *Moderately critical* 13∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass

Affected versions: >=11.4.0 <11.4.9 || >=11.5.0 <11.5.1 Description:  Social Flexible Group is an Open Social extension that allows users to create groups with many different configurations.

In specific uncommon scenarios, where a platform doesn't have any flexible groups with the "Group members only (secret)" visibility, community groups are visible to anonymous users on the /all-groups page. No other group information is revealed since group access is not affected by this issue.

This vulnerability is mitigated by creating a Flexible Group with visibility "Group members only (secret)".

Solution:  Install the latest version:

* If you use the Open Social distribution for Drupal 9.x, upgrade to Open Social 11.5.1 [3] * If you use the Open Social distribution for Drupal 9.x, upgrade to Open Social 11.4.9 [4]

Reported By:  * Tiago Siqueira [5]

Fixed By:  * Tiago Siqueira [6] * Alexander Varwijk [7] * Navneet Singh [8]

Coordinated By:  * cilefen [9] of the Drupal Security Team * Damien McKenna [10] of the Drupal Security Team * Greg Knaddison [11] of the Drupal Security Team

[1] https://www.drupal.org/project/social [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/social/releases/11.5.1 [4] https://www.drupal.org/project/social/releases/11.4.9 [5] https://www.drupal.org/user/2822445 [6] https://www.drupal.org/user/2822445 [7] https://www.drupal.org/user/1868952 [8] https://www.drupal.org/user/3200545 [9] https://www.drupal.org/user/1850070 [10] https://www.drupal.org/user/108450 [11] https://www.drupal.org/user/36762