MEDIUM6.5

GHSA-69q7-hww4-8pjq

phpBB allows CSRF

Quick fix

GHSA-69q7-hww4-8pjq — phpbb/phpbb: upgrade to the fixed version with the command below.

composer require phpbb/phpbb:^3.2.9

Details

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.

Enter the version of the package you're using.

Introduced in: 0Fixed in: 3.2.9

Fixcomposer require phpbb/phpbb:^3.2.9