CVE-2026-122072 Drupal CVE debrief

Who should care

Drupal site administrators and security teams should assess their use of the forum_access module, especially if they have configured private forums with view-only access for certain users. They should verify their module version and configuration to determine if they are affected and take appropriate action.

Why it matters

CVE-2026-122072 is a vulnerability in the Drupal forum_access module that allows users to create topics in private forums they should only have view access to. Defenders should prioritize verifying and updating the module, reviewing configurations, and monitoring for potential exploitation. The vulnerability is addressed in version 2.0.3.

• Defenders need to verify and update the forum_access module to prevent unauthorized topic creation.
• Site administrators must review and adjust forum configurations to mitigate the vulnerability.
• Security teams should monitor for potential exploitation attempts through web services APIs.
• Updating to version 2.0.3 or later is necessary to address the vulnerability.

Technical summary

The Drupal forum_access module does not sufficiently check access for creating forum topics in private forums. This allows users with view-only access to post new topics under certain conditions, such as when the forum field for the topic is not using the default select widget or when content is created through a web services API. The vulnerability is addressed in version 2.0.3 of the module. Defenders should prioritize verifying and updating the forum_access module, especially if it's used in a configuration where users have view-only access to certain forums.

Defensive priority

Defenders should prioritize verifying and updating the forum_access module, especially if it's used in a configuration where users have view-only access to certain forums.

Recommended defensive actions

• Verify the version of the forum_access module in use and update to 2.0.3 or later if necessary.
• Review configurations where the forum field for topics is not using the default select widget and adjust settings accordingly.
• Monitor for and restrict use of web services APIs that could be used to exploit this vulnerability.
• Assess user access controls and ensure that view-only users cannot post topics in private forums.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is confirmed to exist in versions of the forum_access module prior to 2.0.3. Official sources include the CVE Program, NVD, and Drupal's security advisory. The issue allows users with view-only access to post new topics under certain conditions. Evidence is based on CVE Program and NVD records, as well as Drupal's security advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.