[Security-news] Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2025-015

Project: Open Social [1]
Date: 2025-February-12
Security risk: *Less critical* 9 ∕ 25
AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2]
Vulnerability: Access bypass, Information Disclosure

Affected versions: <12.3.11 || >=12.4.0 <12.4.10
Description: 
Open Social is a Drupal distribution for online communities, which ships with
a default module to invite users to groups and events.

Invites for a specific user can be seen under certain conditions.

The issue is mitigated for events by the fact that social_event_max_enroll
has to be enabled.

Solution: 
Install the latest version:

  * If you use Open Social 12.3.x upgrade to Open Social 12.3.11 [3]
  * If you use Open Social 12.4.x upgrade to Open Social 12.4.10 [4]

Reported By: 
  * Robert Ragas (robertragas) [5]
  * zanvidmar [6]

Fixed By: 
  * Denis Kolmerschlag (uber_denis) [7]
  * zanvidmar [8]

Coordinated By: 
  * Greg Knaddison (greggles) [9] of the Drupal Security Team


[1] https://www.drupal.org/project/social
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/social/releases/12.3.11
[4] https://www.drupal.org/project/social/releases/12.4.10
[5] https://www.drupal.org/u/robertragas
[6] https://www.drupal.org/u/zanvidmar
[7] https://www.drupal.org/u/uber_denis
[8] https://www.drupal.org/u/zanvidmar
[9] https://www.drupal.org/u/greggles