Answers.Body: <p>I think it is quite possible that the bulk group add and remove doesn't implement ACLs, which should prevent this. If you can replicate the issue on the <a href="https://wpmaster.demo.civicrm.org/" rel="nofollow noreferrer">wpmaster demo</a>, then you should post an issue on <a href="https://lab.civicrm.org/groups/dev/-/issues" rel="nofollow noreferrer">Gitlab</a>.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-07-15T09:26:15.770Z
Answers.Text: Thanks. I created an [issue](https://lab.civicrm.org/dev/core/-/issues/4432) on Gitlab.
Answers.UserDisplayName: Schorschii
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2023-07-14T14:34:08.777Z
Answers.LastActivityDate: 2023-07-14T14:34:08.777Z
Answers.UserDisplayName: Lars SG
Body: <p>I created a simple permission structure where a group of CiviCRM users (&quot;Group A&quot;) has write access to a group of contacts (&quot;Group B&quot;). (Every logged in user has read access.)</p>
  <p>When a contact is now added to &quot;Group B&quot;, users of &quot;Group A&quot; see the edit button on the contact and can add/remove the contact to/from groups on the contact detail page. When removing the contact from &quot;Group B&quot;, the edit button disappears. So far, everything as expected.</p>
  <p>But when using the actions menu from the search results, users can add/remove group assignments of a contact which is not in &quot;Group B&quot;.</p>
  <p>Isn't this an inconsistency in the permission system? Or am I missing something? How to avoid group membership changes of contacts which are not in &quot;Group B&quot; by users which are in &quot;Group A&quot;?</p>
  <p>I'm using the newest CiviCRM version 5.63.1 under WordPress.</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2023-07-14T13:15:15.743Z
Comments.Text: So users in group A are permitted to see contacts that are not in group B? i.e. they can see contacts in group C?
Comments.UserDisplayName: Andy Clark
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2023-07-15T09:28:02.060Z
Comments.Text: Yes, every logged in user has read access to all contacts.
Comments.UserDisplayName: Schorschii
Tags: <permissions><acl><roles>
Title: Permission system not working as expected
ThreadText: # Permission system not working as expected
  
  (Asked by: username_0 on 2023-07-14)
  
  I created a simple permission structure where a group of CiviCRM users ("Group A") has write access to a group of contacts ("Group B"). (Every logged in user has read access.)
  
  When a contact is now added to "Group B", users of "Group A" see the edit button on the contact and can add/remove the contact to/from groups on the contact detail page. When removing the contact from "Group B", the edit button disappears. So far, everything as expected.
  
  But when using the actions menu from the search results, users can add/remove group assignments of a contact which is not in "Group B".
  
  Isn't this an inconsistency in the permission system? Or am I missing something? How to avoid group membership changes of contacts which are not in "Group B" by users which are in "Group A"?
  
  I'm using the newest CiviCRM version 5.63.1 under WordPress.
  
  **Tags:** permissions, acl, roles
  
  > **Comments:**
  > **username_1**: So users in group A are permitted to see contacts that are not in group B? i.e. they can see contacts in group C?  
  > **username_0**: Yes, every logged in user has read access to all contacts.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2023-07-14. Score: 1
  
  I think it is quite possible that the bulk group add and remove doesn't implement ACLs, which should prevent this. If you can replicate the issue on the [wpmaster demo](https://wpmaster.demo.civicrm.org/), then you should post an issue on [Gitlab](https://lab.civicrm.org/groups/dev/-/issues).
  
  > **Comments:**
  > **username_0**: Thanks. I created an [issue](https://lab.civicrm.org/dev/core/-/issues/4432) on Gitlab.  
  
  ---
  
  