In our CiviCRM installation contacts are either created by staff or they are created by a couple of different webforms. The webforms automatically include a Contact Source, and the staff are supposed to also but maybe don't always. Even if they don't though, the staff will show up in the change log for the contact.

Today I came across a number of contact records that have no Contact Source, don't show any staff touching them in the change log, and have no information in the contact other than an email address. Looking through the database, I'm not seeing any additional information, but I might not know exactly where to look. These contacts aren't registered for events, have no relationships, no memberships, nada. Only an email address.

I wouldn't really be concerned about this, but looking at the dates that these were created, there were a couple here and there a few months ago, but then each month since October 2023, there have been over a hundred each month. So it looks like it could be a growing problem.

I can't think of any way that these contact records are being created! Any ideas what to check? Maybe there is some exposed form somewhere?

1 Answer 1


I found the answer: the /civicrm/mailing/subscribe page is allowing anonymous users to submit. I hadn't noticed that there is a "pending" status for the group subscription.

  • Also, worth noting if anyone else has this issue, "Public" seems to default to actual public, and that may work for some situations. For us, we want public to any authenticated user, which is doable with Drupal permissions.
    – zip
    Feb 1 at 20:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.