The Subuser module before 6.x-1.8 for Drupal does not properly check switch subuser permissions, which allows remote authenticated parent users to change their role by switching to a subuser they created.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Subuser | Boombatower | * | 6.x-1.7 (including) |
| Subuser | Boombatower | 6.x-1.0 (including) | 6.x-1.0 (including) |
| Subuser | Boombatower | 6.x-1.1 (including) | 6.x-1.1 (including) |
| Subuser | Boombatower | 6.x-1.2 (including) | 6.x-1.2 (including) |
| Subuser | Boombatower | 6.x-1.3 (including) | 6.x-1.3 (including) |
| Subuser | Boombatower | 6.x-1.4 (including) | 6.x-1.4 (including) |
| Subuser | Boombatower | 6.x-1.5 (including) | 6.x-1.5 (including) |
| Subuser | Boombatower | 6.x-1.6 (including) | 6.x-1.6 (including) |
| Subuser | Boombatower | 6.x-1.x-dev (including) | 6.x-1.x-dev (including) |