Authenticated data disclosure via callback return handling

Incorrect authorization in HumHub before 1.9.4 and 1.10.0 through 1.10.3 allows remote authenticated users to retrieve other users' data. AccessControl::beforeAction returns the forceChangePassword callback's redirect response instead of false, allowing Yii to continue the requested controller action. Exploitation requires an authenticated account that an administrator has marked for a mandatory password change, and the resulting access is limited to actions otherwise blocked by that restriction.