Kunena 7.0.11 & Kunena 6.4.16 – Security Updates Released and K7.1 in RC1 2

The Kunena team has announce the arrival of three simultaneous security release : K6.4.16, K7.0.11 and K7.1 RC2. Just a reminder K6.4.16 receives only securities fixes untill end of 2026, so it's advised for users to upgrade to K7.0.11. K7.0.11 is the last release of the K7.0 because it's replaced by K7.1 branch with the stable release in the corner. The translations for K7.1 on crowdin.com/project/kunena-forum-7-1 needs to be checked or improved becasue it has been generated by TM (Translation Machine).

Question Users logged into other users accounts

More
7 years 2 months ago #210910 by xreliable
still happening on my site. I'm pretty nervous about this. Seems like a MAJOR security problem.

Please Log in or Create an account to join the conversation.

More
7 years 2 months ago #210929 by xreliable
still happening. there are no permissions problems. I have no old or outdated components or plugins. Everything is up to date. I have purged the users sessions multiple times as well as caches. I ran database tools on the tables. Every user who reported this was using kunena. The last report was a few minutes ago. Is there anything else that I can check?

Please Log in or Create an account to join the conversation.

More
7 years 2 months ago #210997 by xreliable
still happening

Please Log in or Create an account to join the conversation.

More
7 years 2 months ago #211080 by YourFavoriteSpamBot
Could you provide some technical details or more information of any sort?

If this is a general issue, that would be a huge security risk and might force me to temporarily take a site down...

Please Log in or Create an account to join the conversation.

More
7 years 2 months ago - 7 years 2 months ago #211082 by xreliable
I did provide details to the Kunena team but here are some details: When I first experienced this it was using a LitespeedPHP / mariaDB server php v 7.2.20 Latest versions of Kunena/Paid Blue Eagle, and Joomla and EasySocial.

Getting no feedback here from the Kunena team I checked other sources. Apparently this issue has appeared over the years with Joomla for different reasons but almost always as far as I can tell, in conjunction with some sort of caching.

Other than the default Joomla memcache memcached, I was not and am not using any sort of caching. Even on the Litespeed server I was not using the Litespeed joomla plugin.

I moved the site off of Litespeed in case that was the problem to a standard LAMP apache/mysql php 7.2. Not only did this not resolve the problem but almost immediately after moving the site to the new server and only a few users actually logged in, the problem reappeared. It was a minor example of a kunena post displaying in the EasySocial stream by the wrong user but as it was a post from my Joomla administrator account shown as being posted by a regular user, it was a massive disappointment.

I am really disappointed and surprised even, that this issue isn't taken seriously here. It seems like such a massive FUBAR problem that demands attention but I've gotten nothing.
Last edit: 7 years 2 months ago by xreliable.

Please Log in or Create an account to join the conversation.

Time to create page: 0.127 seconds