Still on Drupal 7? Security support for Drupal 7 ended on 5 January 2025. Please visit our Drupal 7 End of Life resources page to review all of your options.
The security issue is caused by a mishandling of boolean access callbacks when OG Features overrides all menu items. Boolean access callbacks in menu items that are explicitly set to FALSE will be open for access.