Drupal Privatemsg Module Security Bypass Security

Test method:

The Program (method) provided on this site may be offensive and only used for security research and teaching. You are at your own risk! A security issue has been reported in the Privatemsg module for Drupal, which can be exploited by malicous users to bypass certain security restrictions.

The security issue exists due to improper access permission checks in the Email Notification (pm_email_policy.module) module and can be exploited to modify the notification template.

Successful exploitation requires the "read privatemsg" permission.

The security issue is reported in versions prior to 6. x-1.2.

Solution
Update to version 6. x-1.2 or later.

Provided and/or discovered
The vendor credits Lee Rowlands.

Original Advisory
SA-CONTRIB-2010-038:
Http://drupal.org/node/784602