Answers.Body: <p>It is but isn't specific to civicrm - the problem in that scenario is allowing anonymous signup without either administrator approval or email verification. Set at least the setting in drupal user settings that sends an email to the email on file and then the owner would have to click a link to verify it.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-07-09T21:52:47.547Z
Answers.Text: E-mail verification. That's what I was missing. Thank you very much!
Answers.UserDisplayName: Russell Ault
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2016-07-09T20:44:40.770Z
Answers.LastActivityDate: 2016-07-09T20:44:40.770Z
Answers.UserDisplayName: Demerit
Body: <p>According to <a href="https://wiki.civicrm.org/confluence/pages/viewpage.action?pageId=86213711">this CiviCRM wiki page</a>, when a new Drupal user is created, its e-mail address is checked against the CiviCRM contacts list and, if a match is found, the new user is associated with the existing contact. While this helps to prevent contact duplication, it seems like it could also represent a potential security problem.</p>
  
  <p>A simple scenario: a membership organization has migrated their existing CRM data to CiviCRM. They would like new members to be able to sign up online, so they allow anonymous Drupal user account creation. Existing members are encouraged to create Drupal users (which get automatically associated with their CiviCRM contact information) so that they can renew their memberships online.</p>
  
  <p>In this scenario, what prevents a malicious person from using an existing contact's e-mail address during Drupal user registration? Using an existing contact's e-mail address (which can be assumed to be fairly public information) would potentially give the malicious person access to all of that contact's personal information, and (if Rules synchronization is implemented) access to other parts of the website they shouldn't have access to.</p>
  
  <p>This appears to me to be a security hole with the potential to expose personal information; am I missing something? How can this be mitigated?</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2016-07-12T17:43:04.713Z
Comments.Text: We had an issue that was sort of similar. We have a signup process that consists of multiple Drupal webforms chained together so it saves at each stage. With Civi's automatic dedupe enabled, when someone filled in the first page with an existing contact's name and email, the created contact was deduped and when they got to the second page the contact's existing details were disclosed. At the time (this was a good couple of years ago) we turned off the automatic deduping.
Comments.UserDisplayName: DaveFF
Tags: <drupal><security><user-account>
Title: Is automatic new Drupal user to existing CiviCRM contact linking a possible security vulnterability?
ThreadText: # Is automatic new Drupal user to existing CiviCRM contact linking a possible security vulnterability?
  
  (Asked by: username_0 on 2016-07-09)
  
  According to [this CiviCRM wiki page](https://wiki.civicrm.org/confluence/pages/viewpage.action?pageId=86213711), when a new Drupal user is created, its e-mail address is checked against the CiviCRM contacts list and, if a match is found, the new user is associated with the existing contact. While this helps to prevent contact duplication, it seems like it could also represent a potential security problem.
  
  A simple scenario: a membership organization has migrated their existing CRM data to CiviCRM. They would like new members to be able to sign up online, so they allow anonymous Drupal user account creation. Existing members are encouraged to create Drupal users (which get automatically associated with their CiviCRM contact information) so that they can renew their memberships online.
  
  In this scenario, what prevents a malicious person from using an existing contact's e-mail address during Drupal user registration? Using an existing contact's e-mail address (which can be assumed to be fairly public information) would potentially give the malicious person access to all of that contact's personal information, and (if Rules synchronization is implemented) access to other parts of the website they shouldn't have access to.
  
  This appears to me to be a security hole with the potential to expose personal information; am I missing something? How can this be mitigated?
  
  **Tags:** drupal, security, user-account
  
  > **Comments:**
  > **username_1**: We had an issue that was sort of similar. We have a signup process that consists of multiple Drupal webforms chained together so it saves at each stage. With Civi's automatic dedupe enabled, when someone filled in the first page with an existing contact's name and email, the created contact was deduped and when they got to the second page the contact's existing details were disclosed. At the time (this was a good couple of years ago) we turned off the automatic deduping.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2016-07-09. Score: 6 | Accepted answer
  
  It is but isn't specific to civicrm - the problem in that scenario is allowing anonymous signup without either administrator approval or email verification. Set at least the setting in drupal user settings that sends an email to the email on file and then the owner would have to click a link to verify it.
  
  > **Comments:**
  > **username_0**: E-mail verification. That's what I was missing. Thank you very much!  
  
  ---
  
  