Today we realized that anonymous users may subscribe to internal mailinglist groups in following scenario:

  1. We send a mass mailing to some internal groups which are not marked as public visible.
  2. A user receiving this mailing uses his/her mailer's "List unsubscribe" feature which utilizes the mail header "List unsubscribe"
  3. Civi sends a confirmation with an option to rollback the unsubscription for all groups the mailing addresses not only for those the user belongs to.
  4. Use this rollback fetaure and the user besomes a member of all groups used in the mailing :(

If this is the expected behaviour,

  • the help text for mailing groups visibility should be changed, I think. Atm it's stating something like "Choose »users and administrators« if only authed users may add members to this group." And
  • the groups have to be filtered to include only those, the recipoient is member of.

CiviCRM version 5.25.0

Does anybody know how to block those unauthed subscriptions?

  • I just edited the automatic confrmation templates and removed the possibility to re-subscribe. Maybe this is enough. But is it secure?
    – nielo
    Jun 30 '20 at 9:53
  • Thanks for tracking this down. IMHO the rollback feature should only resusbcribe the user for the groups he/she was a member of in the first place. No idea though how this is implemented in CiviCRM's core code.
    – Fabian
    Jun 30 '20 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.