Skip to content
OpenAdvisories
Unscored DRUPAL-CONTRIB-2021-003

This module enables you to add groups to other groups in a tree structure where access can be inherited up or down the tree. When you confi…

Published Jan 27, 2021 · Updated Sep 10, 2026 · Assigned by DRUPAL

Description

This module enables you to add groups to other groups in a tree structure where access can be inherited up or down the tree.

When you configure Subgroup to have a tree with at least three levels, users may inadvertently get permissions in a group that is an uncle or cousin of the source group, rather than a direct ancestor or descendant. Trees with only multiple nodes at the lowest tier (or nowhere) are unaffected.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist drupal/subgroup >= 1.0.0, <= 1.0.0 — DRUPAL-CONTRIB-2021-003

References