Body: <p>Today we realized that anonymous users may subscribe to internal mailinglist groups in following scenario:</p>
  <ol>
  <li>We send a mass mailing to some internal groups which are not marked as public visible.</li>
  <li>A user receiving this mailing uses his/her mailer's &quot;List unsubscribe&quot; feature which utilizes the mail header &quot;List unsubscribe&quot;</li>
  <li>Civi sends a confirmation with an option to rollback the unsubscription for <strong>all groups the mailing addresses</strong> not only for those the user belongs to.</li>
  <li>Use this rollback fetaure and the user besomes a member of all groups used in the mailing :(</li>
  </ol>
  <p>If this is the expected behaviour,</p>
  <ul>
  <li>the help text for mailing groups visibility should be changed, I think. Atm it's stating something like &quot;Choose »users and administrators« if only authed users may add members to this group.&quot; And</li>
  <li>the groups have to be filtered to include only those, the recipoient is member of.</li>
  </ul>
  <p>CiviCRM version 5.25.0</p>
  <p>Does anybody know how to block those unauthed subscriptions?</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2020-06-30T09:53:16.140Z
Comments.Text: I just edited the automatic confrmation templates and removed the possibility to re-subscribe. Maybe this is enough. But is it secure?
Comments.UserDisplayName: nielo
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2020-06-30T12:26:01.583Z
Comments.Text: Thanks for tracking this down. IMHO the rollback feature should only resusbcribe the user for the groups he/she was a member of in the first place. No idea though how this is implemented in CiviCRM's core code.
Comments.UserDisplayName: Fabian
Tags: <civimail>
Title: CiviMail: Anonymous subscriptions are allowed to groups with visibility for users and administrators!
ThreadText: # CiviMail: Anonymous subscriptions are allowed to groups with visibility for users and administrators!
  
  (Asked by: username_0 on 2020-06-30)
  
  Today we realized that anonymous users may subscribe to internal mailinglist groups in following scenario:
  
  1. We send a mass mailing to some internal groups which are not marked as public visible.
  2. A user receiving this mailing uses his/her mailer's "List unsubscribe" feature which utilizes the mail header "List unsubscribe"
  3. Civi sends a confirmation with an option to rollback the unsubscription for **all groups the mailing addresses** not only for those the user belongs to.
  4. Use this rollback fetaure and the user besomes a member of all groups used in the mailing :(
  
  If this is the expected behaviour,
  
  * the help text for mailing groups visibility should be changed, I think. Atm it's stating something like "Choose »users and administrators« if only authed users may add members to this group." And
  * the groups have to be filtered to include only those, the recipoient is member of.
  
  CiviCRM version 5.25.0
  
  Does anybody know how to block those unauthed subscriptions?
  
  **Tags:** civimail
  
  > **Comments:**
  > **username_0**: I just edited the automatic confrmation templates and removed the possibility to re-subscribe. Maybe this is enough. But is it secure?  
  > **username_1**: Thanks for tracking this down. IMHO the rollback feature should only resusbcribe the user for the groups he/she was a member of in the first place. No idea though how this is implemented in CiviCRM's core code.  
  
  ---
  
  ## 0 answers
  
  