CVE-2022-24865: Incorrect Authorization (CWE-863)
value: HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password by an administrator may retrieve other users' data. This issue has been resolved by commit `eb83de20`. It is recommended that the HumHub is upgraded to 1.11.0, 1.10.4 or 1.9.4. There are no known workarounds for this issue.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 6.5
Published: 2022-04-20T20:15Z
Repository: https://github.com/humhub/humhub
Language: PHP
Files changed: CHANGELOG.md, protected/humhub/components/behaviors/AccessControl.php
Commit date: 2022-04-19 17:57:30 +0200
Commit message: Fix must change password (#5638)

* Fix must change password

* Update CHANGELOG.md (#5638)

* Improve access validation

* Update CHANGELOG.md

Co-authored-by: Lucas Bartholemy <luke-@users.noreply.github.com>
Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5ca2b4d5b..2b1eb03ba 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,10 +7,11 @@ HumHub Changelog
 - Fix #5479: Fix ContentContainerPermissionAccess without provided container
 - Fix #5513: Fix PermaLink controller error for content without container
 - Fix #5517: Don't send "Follows" notification on request friendship
 - Fix #5563: Limit backup duration of RichText editor for 2 hours
 - Enh #5601: Backup RichText in sessionStorage
+- Fix #5638: Removed return values from `codeCallback`
 - Fix #5634: Fix tests NonceCest
 - Fix #5644: Fix console command space/assign-all-members
 
 1.10.3 (December 20, 2021)
 --------------------------
diff --git a/protected/humhub/components/behaviors/AccessControl.php b/protected/humhub/components/behaviors/AccessControl.php
index e23911fd5..954f6fe86 100644
--- a/protected/humhub/components/behaviors/AccessControl.php
+++ b/protected/humhub/components/behaviors/AccessControl.php
@@ -9,13 +9,11 @@
 namespace humhub\components\behaviors;
 
 use humhub\components\access\ControllerAccess;
 use Yii;
 use yii\base\ActionFilter;
-use yii\helpers\Url;
 use yii\web\HttpException;
-use yii\web\Response;
 
 /**
  * Handles the AccessControl for a Controller.
  *
  * Controller level AccessRules can be provided by either setting the [[rules]] array,
@@ -149,16 +147,17 @@ class AccessControl extends ActionFilter
         if (!$this->controllerAccess->run()) {
             if (isset($this->controllerAccess->codeCallback) &&
                 method_exists($this, $this->controllerAccess->codeCallback)) {
                 // Call a specific function for current action filter,
                 // may be used to filter a logged in user for some restriction e.g. "must change password"
-                return call_user_func([$this, $this->controllerAccess->codeCallback]);
+                call_user_func([$this, $this->controllerAccess->codeCallback]);
             } else if ($this->controllerAccess->code == 401) {
-                return $this->loginRequired();
+                $this->loginRequired();
             } else {
                 $this->forbidden();
             }
+            return false;
         }
 
         return parent::beforeAction($action);
     }
 
@@ -215,43 +214,39 @@ class AccessControl extends ActionFilter
     {
         throw new HttpException($this->controllerAccess->code, $this->controllerAccess->reason);
     }
 
     /**
-     * @return bool forces user login
+     * Force user to log in
      */
     protected function loginRequired()
     {
         Yii::$app->user->logout();
         Yii::$app->user->loginRequired();
-
-        return false;
     }
 
     /**
-     * @return Response Redirect user to force to change password
+     * Force user to redirect to change password
      * @since 1.8
      */
     protected function forceChangePassword()
     {
         if (!Yii::$app->user->isMustChangePasswordUrl()) {
-            return Yii::$app->getResponse()->redirect(Url::toRoute(Yii::$app->user->mustChangePasswordRoute));
+            Yii::$app->getResponse()->redirect([Yii::$app->user->mustChangePasswordRoute]);
         }
     }
 
     /**
      * Log out all non admin users when maintenance mode is active
-     *
-     * @return Response Redirect to home page
      * @since 1.8
      */
     protected function checkMaintenanceMode()
     {
         if (Yii::$app->settings->get('maintenanceMode')) {
             if (!Yii::$app->user->isGuest) {
                 Yii::$app->user->logout();
                 Yii::$app->getView()->warn(Yii::t('error', 'Maintenance mode activated: You have been automatically logged out and will no longer have access the platform until the maintenance has been completed.'));
             }
-            return Yii::$app->getResponse()->redirect(['/user/auth/login']);
+            Yii::$app->getResponse()->redirect(['/user/auth/login']);
         }
     }
 }

Vulnerable code: use yii\helpers\Url;
use yii\web\Response;
                return call_user_func([$this, $this->controllerAccess->codeCallback]);
                return $this->loginRequired();
     * @return bool forces user login

        return false;
     * @return Response Redirect user to force to change password
            return Yii::$app->getResponse()->redirect(Url::toRoute(Yii::$app->user->mustChangePasswordRoute));
     *
     * @return Response Redirect to home page
            return Yii::$app->getResponse()->redirect(['/user/auth/login']);
Fixed code: - Fix #5638: Removed return values from `codeCallback`
                call_user_func([$this, $this->controllerAccess->codeCallback]);
                $this->loginRequired();
            return false;
     * Force user to log in
     * Force user to redirect to change password
            Yii::$app->getResponse()->redirect([Yii::$app->user->mustChangePasswordRoute]);
            Yii::$app->getResponse()->redirect(['/user/auth/login']);