Answers.Body: <p>That message indicates a security update is available which will fix potential security vulnerabilities in your site. You or your system administrator should upgrade to the latest version of CiviCRM as soon as possible.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-11-10T18:43:59.843Z
Answers.Text: Thank you. The person who works on our site is saying this notification can be ignored as a security update was done back in January and this is enough. I have expressed my concerns but I’m being told to ignore the critical status.
Answers.UserDisplayName: user18407
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-11-11T08:12:48.093Z
Answers.Text: It could well be that the security vulnerability that is fixed does not apply to your situation. If you are not sure you can always ask one of the CiviCRM experts (https://civicrm.org/civicrm/experts) for a second opinion? There is always a balance. As Coleman pointed out the latest release might fix security vulnerabilities but it is also the least tested as it is less used :-)
Answers.UserDisplayName: ErikH - CiviCooP
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-11-11T08:14:07.553Z
Answers.Text: But if you are not using any extensions or any customizations it would make sense to always upgrade to the latest version.
Answers.UserDisplayName: ErikH - CiviCooP
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-11-11T12:02:32.663Z
Answers.Text: Opinions do vary, but I don't really understand those who spend longer justifying why they don't need to upgrade than it would take to just do it and deal with any fallout.  If your site is particularly big/complex/fragile then approach all upgrades with caution but in many cases it's a no-brainer.
Answers.UserDisplayName: Aidan
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-11-11T14:51:37.760Z
Answers.Text: It is not so much the fallout Aidan, that is hardly ever a problem. The amount of time the users need to invest to test does sometimes make it an issue if something as big as CiviSepa or CiviBanking is involved. And that definitily takes more time than a justification. But as mentioned before, if there is little customization: upgrade :-)
Answers.UserDisplayName: ErikH - CiviCooP
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-11-11T17:46:05.107Z
Answers.Text: Thanks everyone. Very small site with pretty much no customisation that I’m aware of. A standard small charity using it for storing data and mailings. We use Drupal as a front end and a big upgrade was necessary there but the security updates on Civi are not as the developer says the upgrade at the end of last year was enough.
Answers.UserDisplayName: user18407
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-11-12T18:04:12.143Z
Answers.Text: There's no one-size-fits-all answer to this question, which is not specific to CiviCRM. BUT, I think it is fair to insist that anyone managing your code be more specific than that. CiviCRM has https://civicrm.org/advisory and there were a bunch of issues that were fixed in October. Unless your site is protected in other ways, there's a good chance that at least one of those is applicable and your site is vulnerable.
Answers.UserDisplayName: Alan Dixon
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-11-10T15:19:58.007Z
Answers.LastActivityDate: 2024-11-10T15:19:58.007Z
Answers.UserDisplayName: Coleman
Body: <p>We are on CIVICRM 5.68 and the alert says the security status is critical. What does this mean and is it a problem?</p>
  
Tags: <security>
Title: Does it matter if CIVICRM is telling me the system security status is critical?
ThreadText: # Does it matter if CIVICRM is telling me the system security status is critical?
  
  (Asked by: username_0 on 2024-11-10)
  
  We are on CIVICRM 5.68 and the alert says the security status is critical. What does this mean and is it a problem?
  
  **Tags:** security
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2024-11-10. Score: 3
  
  That message indicates a security update is available which will fix potential security vulnerabilities in your site. You or your system administrator should upgrade to the latest version of CiviCRM as soon as possible.
  
  > **Comments:**
  > **username_0**: Thank you. The person who works on our site is saying this notification can be ignored as a security update was done back in January and this is enough. I have expressed my concerns but I’m being told to ignore the critical status.  
  > **username_2**: It could well be that the security vulnerability that is fixed does not apply to your situation. If you are not sure you can always ask one of the CiviCRM experts (https://civicrm.org/civicrm/experts) for a second opinion? There is always a balance. As username_1 pointed out the latest release might fix security vulnerabilities but it is also the least tested as it is less used :-)  
  > **username_2**: But if you are not using any extensions or any customizations it would make sense to always upgrade to the latest version.  
  > **username_3**: Opinions do vary, but I don't really understand those who spend longer justifying why they don't need to upgrade than it would take to just do it and deal with any fallout.  If your site is particularly big/complex/fragile then approach all upgrades with caution but in many cases it's a no-brainer.  
  > **username_2**: It is not so much the fallout username_3, that is hardly ever a problem. The amount of time the users need to invest to test does sometimes make it an issue if something as big as CiviSepa or CiviBanking is involved. And that definitily takes more time than a justification. But as mentioned before, if there is little customization: upgrade :-)  
  > **username_0**: Thanks everyone. Very small site with pretty much no customisation that I’m aware of. A standard small charity using it for storing data and mailings. We use Drupal as a front end and a big upgrade was necessary there but the security updates on Civi are not as the developer says the upgrade at the end of last year was enough.  
  > **username_4**: There's no one-size-fits-all answer to this question, which is not specific to CiviCRM. BUT, I think it is fair to insist that anyone managing your code be more specific than that. CiviCRM has https://civicrm.org/advisory and there were a bunch of issues that were fixed in October. Unless your site is protected in other ways, there's a good chance that at least one of those is applicable and your site is vulnerable.  
  
  ---
  
  