View online: https://www.drupal.org/sa-contrib-2025-015 Project: Open Social [1] Date: 2025-February-12 Security risk: *Less critical* 9 ∕ 25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass, Information Disclosure Affected versions: <12.3.11 || >=12.4.0 <12.4.10 Description:  Open Social is a Drupal distribution for online communities, which ships with a default module to invite users to groups and events. Invites for a specific user can be seen under certain conditions. The issue is mitigated for events by the fact that social_event_max_enroll has to be enabled. Solution:  Install the latest version: * If you use Open Social 12.3.x upgrade to Open Social 12.3.11 [3] * If you use Open Social 12.4.x upgrade to Open Social 12.4.10 [4] Reported By:  * Robert Ragas (robertragas) [5] * zanvidmar [6] Fixed By:  * Denis Kolmerschlag (uber_denis) [7] * zanvidmar [8] Coordinated By:  * Greg Knaddison (greggles) [9] of the Drupal Security Team [1] https://www.drupal.org/project/social [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/social/releases/12.3.11 [4] https://www.drupal.org/project/social/releases/12.4.10 [5] https://www.drupal.org/u/robertragas [6] https://www.drupal.org/u/zanvidmar [7] https://www.drupal.org/u/uber_denis [8] https://www.drupal.org/u/zanvidmar [9] https://www.drupal.org/u/greggles