I have observed the following behaviour during testing an ACL-Setup. Could anyone let me know if this is the expected behaviour and if there are any more or less particular plans to change that in the future?
A user is only granted access (via ACL) to a limited group of contacts - that seems to work fine. The user will also be able to create groups via the CiviCRM UI - that makes sense too.
However the user won't be able to add contacts visible to them to the group they just created unless an administrator creates another ACL Permission explicitly for that group.
For me the expected result would have been that the user can add visible contacts to any CiviCRM Group (unless maybe it is an acl-group). I think that was also the behaviour in earlier CiviCRM Versions (I am currently testing on 5.51.1). I suspect that something was changed in CiviCRM Core because users used to be able to add themselves to ACL-groups thus escalating privileges.
In short I would be happy to get some feedback on:
- Is this a bug or a feature?
- Is there any documentation / information on the (changed) behaviour described here? Such as adding CMS-permissions to add contacts to regular groups, ACL groups etc...
- Are there any plans to further change / adapt / extend the behaviour of ACLs in CiviCRM?
