Drupal Group Invite Module Access Bypass Vulnerability

An access bypass vulnerability has been identified in the Drupal Group Invite module, specifically in versions prior to 2.3.9, as well as in the 3.0.0 through 3.0.4 and 4.0.0 through 4.0.4 ranges. This vulnerability allows unauthorized users to access group content by exploiting insufficient access checks under certain conditions. The issue arises when users with the permission to create group invites perform specific, less common actions.

Impact

Exploitation of this vulnerability allows for unauthorized access to group content, bypassing normal access controls.

Remediation

Users of the Group Invite module should upgrade to version 2.3.9, 3.0.4, or 4.0.4, depending on their current version.