I believe I have found a worrying security hole.
If a member is downgraded from a private forum they still receive email subscriptions.
To expand: we have a private forum for special members. Those members often subscribe to receive an email alert of new postings to that forum. When a member is demoted from that private forum their email alert remains operational and continues to send them a private email containing the full text of any posting made to that private forum.
This worries me considerably...people are usually demoted from private areas with good reason...and administrators (and others) are completely unaware that they are still being sent private information.
I can use database tools as a workaround (delete such subscriptions) but I believe:
- administrators need to be made aware of this immediately
- a modification needs to be done to correct such orphaned subscriptions and prevent them recurring.
Topic Options
Post Options
Thanks(0)
