Answers.Body: <p>I've posted an advisory now: <a href="https://civicrm.org/advisory/civi-sa-2015-008-acl-bypass-in-467" rel="noreferrer">CIVI-SA-2015-008: Access bypass in CiviCRM 4.6.7</a></p>
  <blockquote>
  <p>CiviCRM 4.6.7 introduced an access bypass issue which applied a limited number of sites.</p>
  <p>The issue affected only certain configurations, where the site used ACLs to limit access, and applied to users whose permissions included “access CiviCRM” and “view my contact” but not “view all contacts”. Changes introduced in CRM-16512 allowed the “view my contact” permission for those users to incorrectly grant access to all contacts.</p>
  <p>This issue is mitigated by the fact that only sites so configured are affected, but for sites affected the potential severity led us to make an out of schedule security release.</p>
  </blockquote>
  <ul>
  <li>If your users with &quot;access CiviCRM&quot; also have access to all contacts (many smaller sites), you are not affected</li>
  <li>If you are not using ACL functionality, you are not affected</li>
  <li>If you did not upgrade to 4.6.7, you are not affected (but you should check you have applied the security fixes in that version!)</li>
  </ul>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-08-26T21:57:52.527Z
Answers.LastActivityDate: 2015-08-26T21:57:52.527Z
Answers.LastEditDate: 2020-06-17T09:00:50.810Z
Answers.UserDisplayName: Chris Burgess
Body: <p>Email was received stating</p>
  
  <blockquote>
    <p>If you are currently using 4.6.7 and your site uses ACLs to segment access to contacts you are strongly encouraged to upgrade. The 4.6.7 release included a regression in the ACL system which caused certain contact access permissions to behave improperly. The 4.4 LTS branch was unaffected.</p>
  </blockquote>
  
  <p>There is no additional information provided at <a href="https://civicrm.org/advisory">https://civicrm.org/advisory</a>, and I don't see any issues in the Jira queue marked with a 4.6.8 fix version that would give more context for site administrators to judge whether an immediate upgrade is necessary or if it could be delayed.</p>
  
Tags: <acl><security><admin>
Title: How do I find more information about the ACL regression introduced in 4.6.7?
ThreadText: # How do I find more information about the ACL regression introduced in 4.6.7?
  
  (Asked by: username_0 on 2015-08-26)
  
  Email was received stating
  
  > If you are currently using 4.6.7 and your site uses ACLs to segment access to contacts you are strongly encouraged to upgrade. The 4.6.7 release included a regression in the ACL system which caused certain contact access permissions to behave improperly. The 4.4 LTS branch was unaffected.
  
  There is no additional information provided at <https://civicrm.org/advisory>, and I don't see any issues in the Jira queue marked with a 4.6.8 fix version that would give more context for site administrators to judge whether an immediate upgrade is necessary or if it could be delayed.
  
  **Tags:** acl, security, admin
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2015-08-26. Score: 6 | Accepted answer
  
  I've posted an advisory now: [CIVI-SA-2015-008: Access bypass in CiviCRM 4.6.7](https://civicrm.org/advisory/civi-sa-2015-008-acl-bypass-in-467)
  
  > CiviCRM 4.6.7 introduced an access bypass issue which applied a limited number of sites.
  >
  > The issue affected only certain configurations, where the site used ACLs to limit access, and applied to users whose permissions included “access CiviCRM” and “view my contact” but not “view all contacts”. Changes introduced in CRM-16512 allowed the “view my contact” permission for those users to incorrectly grant access to all contacts.
  >
  > This issue is mitigated by the fact that only sites so configured are affected, but for sites affected the potential severity led us to make an out of schedule security release.
  
  * If your users with "access CiviCRM" also have access to all contacts (many smaller sites), you are not affected
  * If you are not using ACL functionality, you are not affected
  * If you did not upgrade to 4.6.7, you are not affected (but you should check you have applied the security fixes in that version!)
  
  
  ---
  
  