Threats tagged 'drupal-contrib-2026-303'

The Drupal forum_access module contains an access control vulnerability that allows users to create new topics in private forums where they should only have view access. This occurs due to insufficient access checks when creating forum topics, specifically when the forum field is not using the default select widget or when content is created via the web services API. The issue is fixed in version 2.0.3 of the module.