I have observed the following behaviour during testing an ACL-Setup. Could anyone let me know if this is the expected behaviour and if there are any more or less particular plans to change that in the future?!

A user is only granted access (via ACL) to a limited group of contacts - that seems to work fine. The user will also be able to create groups via the CiviCRM UI - that makes sense too.

However the user wont be able to add contacts visible to her/him to the group just created unless an administrator creates another ACL Permission explicitly for that group.

For me the expected result would have been that the user can add visible contacts to any CiviCRM Group (unless maybe it is an acl-group). I think that was also the behaviour in earlier CiviCRM Versions (I am currently testing on 5.51.1). I suspect that something was changed in CiviCRM Core because users used to be able to add themselves to ACL-groups thus escalating priviliges.

In short I would be happy to get some feedback on:

  • Is this a bug or a feature?
  • Is there any documentation / informationen on the (changed) behaviour described here? Such as adding CMS-permissions to add contacts to regular groups, acl groups etc...
  • Are there any plans to further change / adapt / extend the behaviour of ACL in CiviCRM?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.