Body: <p>My expectation was that a user without Administrate CiviCRM permission would not be able to see another user's mailings in the Recipients: Include Mailing list.</p>
  
  <p>Instead a user with access over <strong>List A</strong> can select a previous mailing that went to <strong>List B</strong> that they don't have permissions over. Would that mailing deliver? Is that not a loophole in the ACL?</p>
  
  <p>Happy to be corrected if I'm missing an easy setting.</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-04-03T18:33:49.497Z
Comments.Text: This refers to 'mailings' but I wonder if it should be saying 'Mailing List/Group'
Comments.UserDisplayName: petednz - fuzion
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-04-04T12:19:23.897Z
Comments.Text: Hi, are you saying my question should refer to 'Mailing List/Group' or the CiviCRM UI should be clearer?
Comments.UserDisplayName: Leckie
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2018-04-04T19:22:03.450Z
Comments.Text: Your question. sorry i wasn't clear. You say "see another user's mailings" which I initially read as worded - but later realised this was to do with seeing Groups, not mailings (also in title)
Comments.UserDisplayName: petednz - fuzion
Tags: <civimail><permissions><acl>
Title: All CiviMail users can see every mailing in 'Include Mailing', even ones they shouldn't have access to
ThreadText: # All CiviMail users can see every mailing in 'Include Mailing', even ones they shouldn't have access to
  
  (Asked by: username_0 on 2018-04-03)
  
  My expectation was that a user without Administrate CiviCRM permission would not be able to see another user's mailings in the Recipients: Include Mailing list.
  
  Instead a user with access over **List A** can select a previous mailing that went to **List B** that they don't have permissions over. Would that mailing deliver? Is that not a loophole in the ACL?
  
  Happy to be corrected if I'm missing an easy setting.
  
  **Tags:** civimail, permissions, acl
  
  > **Comments:**
  > **username_1**: This refers to 'mailings' but I wonder if it should be saying 'Mailing List/Group'  
  > **username_0**: Hi, are you saying my question should refer to 'Mailing List/Group' or the CiviCRM UI should be clearer?  
  > **username_1**: Your question. sorry i wasn't clear. You say "see another user's mailings" which I initially read as worded - but later realised this was to do with seeing Groups, not mailings (also in title)  
  
  ---
  
  ## 0 answers
  
  