FUDForum 2.6.15 with "Tree View" enabled, as used in other products such as phpgroupware and egroupware, allows remote attackers to read pr…

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Advisories 2

• DSA-899-1 egroupware - programming errors Debian Security (DSA / DLA) · Mar 9, 2026
• DSA-798-1 phpgroupware - several Debian Security (DSA / DLA) · Mar 9, 2026

References

• 16414 third-party-advisory
• 14556 vdb-entry
• 20050811 Fudforum: incompletely check of user rights in tree view gaining access to all messages mailing-list
• DSA-798 vendor-advisory
• DSA-899 vendor-advisory
• 17643 third-party-advisory