I would like to confirm this statements regarding permissions, ACL and groups (Wordpress 4.7.1, civicrm 4.7.15)

  1. Permission to edit contacts (ACL or general), allows user to assign contacts to ANY group
  2. As 1 is true, user can add himself to another group and thus obtain its ACL related permissions

This is a serious issue for us as it hinders the flexible security management ACL provides. I would like to evaluate viability of a feature to solve this problem. I see two approaches:

  1. A general permission (not ACL related, in wordpress related to wordpress user role) which would control assignment to control access groups (this will be enough for our organization)
  2. As 1, combined with ACL permissions (p.e. denied general permission but allowed assignment to certain control access groups through ACL)

I would be capable to work in any of this approaches (1 in first phase, then 2) but I am not yet very familiar with civicrm code structure. Can you point out the possible problems and difficulties of implementation of these features? Is there any related isssue in Jira?

Thank you

  • I ran into the same issue. It's rather insane behaviour if you ask me.
    – Nuoji
    Feb 2, 2018 at 10:23
  • FWIW I can't confirm this on CiviCRM 5.10 (and Drupal 7) - users who only have access to contacts by way of an ACL rule cannot add people to any group; therefore cannot add themself or anyone else into a group that would grant ACL access. Mar 14, 2019 at 17:42
  • We have the same question... @Daniel Martinez did you finally find out how to do what you wanted ?
    – fred neau
    Sep 18, 2023 at 12:24

1 Answer 1


Permissions control is not related to Civi groups. It is controlled by WordPress user roles as you suggest for #1 fix. You should have no trouble from a security management stand point to set it up so staff cannot assign themselves to other roles.

You might want to add this plugin for better control. https://www.role-editor.com/

  • Ok, maybe my question was not clear enough: - Permission control is related to Civi (access control) groups when using ACL - Possible permissions: "permission to change own group" or "assign user to control access groups" is not included in civicrm (wordpress)role-related permission set (phase #1 will change that) - Problem described is not related to user changing his/her own role but changing his own access control group and (through it) its ACL related permissions Feb 17, 2017 at 10:55
  • There is a difference between WordPress User (create/edit/delete) and Civi Contacts (create/edit/delete). If you follow my answer above--Your Admin Role has access to WP User create/edit/delete (they are the only ones that can set Civi ACLs). You create your other Roles that need access to edit Civi contacts without WP User access and they cannot assign themselves to other ACL groups. Maybe my User Roles look different because I use the above mentioned plugin.
    – Iowa Boy
    Apr 26, 2017 at 2:52
  • Even if WP user does not have WP user-related perms, it can change its contact's own groups in the CRM database, giving him civi permissions related to those groups (i.e. "London manager" can assign himself to group "Paris manager" giving him access to Paris contacts) May 10, 2017 at 12:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.