I am using Civi 5.38 on a WordPress site, and have a query on ACL permissions.

We want to use different tiers of access for the information stored in custom data sets. We have created ACLs and applied them to contact groups to control this which all works fine however it seems that it's possible that a non member of a certain group (who can edit records) could effectively add themselves into a higher level group and so inherit the ACL. I've seen suggestions of disabling groups once set but they are able to just re-enable them. I've also tested an extension called group-protect which protects them and this does seem to work, however I feel I'm missing something as it seems an obvious loophole in the security out of the box? Thanks


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.