The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not properly check access permissions, which allows remote authenticated users to post tweets to arbitrary accounts by leveraging the (1) โpost to twitterโ permission or change the options for arbitrary attached accounts by leveraging the (2) โadd twitter accountsโ or (3) โadd authenticated twitter accountsโ permission.