the issue wasn’t noticed during testing and has only surfaced a week after the release of 3.0.7.

Working feeds were promised for phpBB 3.0.7, however a critical bug in the permission handling for feeds slipped past. To all people who already have updated to 3.0.7, it is of critical importance to update to 3.0.7-PL1. Otherwise, it is possible for users to bypass permission settings under the following circumstances:

- Feeds are enabled

- Any of the posts or topics feeds are enabled

- The unauthorised user – or one of the groups they are a member of – has forum permissions set on a private forum

- If you have excluded a forum from the list of forums that provide feeds, it is unaffected

The fix for the issue is a single line change inside of feed.php, line 525 has changed from:

$forum_ids = array_keys($auth->acl_getf('f_read'));

to:

$forum_ids = array_keys($auth->acl_getf('f_read', true));

There were no other changes, in particular neither style nor language changes.