8

Email was received stating

If you are currently using 4.6.7 and your site uses ACLs to segment access to contacts you are strongly encouraged to upgrade. The 4.6.7 release included a regression in the ACL system which caused certain contact access permissions to behave improperly. The 4.4 LTS branch was unaffected.

There is no additional information provided at https://civicrm.org/advisory, and I don't see any issues in the Jira queue marked with a 4.6.8 fix version that would give more context for site administrators to judge whether an immediate upgrade is necessary or if it could be delayed.

6

I've posted an advisory now: CIVI-SA-2015-008: Access bypass in CiviCRM 4.6.7

CiviCRM 4.6.7 introduced an access bypass issue which applied a limited number of sites.

The issue affected only certain configurations, where the site used ACLs to limit access, and applied to users whose permissions included “access CiviCRM” and “view my contact” but not “view all contacts”. Changes introduced in CRM-16512 allowed the “view my contact” permission for those users to incorrectly grant access to all contacts.

This issue is mitigated by the fact that only sites so configured are affected, but for sites affected the potential severity led us to make an out of schedule security release.

  • If your users with "access CiviCRM" also have access to all contacts (many smaller sites), you are not affected
  • If you are not using ACL functionality, you are not affected
  • If you did not upgrade to 4.6.7, you are not affected (but you should check you have applied the security fixes in that version!)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.