Answers.Body: <p>I found the answer: the /civicrm/mailing/subscribe page is allowing anonymous users to submit. I hadn't noticed that there is a &quot;pending&quot; status for the group subscription.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-02-01T20:32:48.790Z
Answers.Text: Also, worth noting if anyone else has this issue, "Public" seems to default to actual public, and that may work for some situations. For us, we want public to any authenticated user, which is doable with Drupal permissions.
Answers.UserDisplayName: zip
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-02-01T19:59:18.220Z
Answers.LastActivityDate: 2024-02-01T19:59:18.220Z
Answers.UserDisplayName: zip
Body: <p>In our CiviCRM installation contacts are either created by staff or they are created by a couple of different webforms. The webforms automatically include a Contact Source, and the staff are supposed to also but maybe don't always. Even if they don't though, the staff will show up in the change log for the contact.</p>
  <p>Today I came across a number of contact records that have no Contact Source, don't show any staff touching them in the change log, and have no information in the contact other than an email address. Looking through the database, I'm not seeing any additional information, but I might not know exactly where to look. These contacts aren't registered for events, have no relationships, no memberships, nada. Only an email address.</p>
  <p>I wouldn't really be concerned about this, but looking at the dates that these were created, there were a couple here and there a few months ago, but then each month since October 2023, there have been over a hundred each month. So it looks like it could be a growing problem.</p>
  <p>I can't think of any way that these contact records are being created! Any ideas what to check? Maybe there is some exposed form somewhere?</p>
  
Tags: <contacts>
Title: Finding source of contacts
ThreadText: # Finding source of contacts
  
  (Asked by: username_0 on 2024-02-01)
  
  In our CiviCRM installation contacts are either created by staff or they are created by a couple of different webforms. The webforms automatically include a Contact Source, and the staff are supposed to also but maybe don't always. Even if they don't though, the staff will show up in the change log for the contact.
  
  Today I came across a number of contact records that have no Contact Source, don't show any staff touching them in the change log, and have no information in the contact other than an email address. Looking through the database, I'm not seeing any additional information, but I might not know exactly where to look. These contacts aren't registered for events, have no relationships, no memberships, nada. Only an email address.
  
  I wouldn't really be concerned about this, but looking at the dates that these were created, there were a couple here and there a few months ago, but then each month since October 2023, there have been over a hundred each month. So it looks like it could be a growing problem.
  
  I can't think of any way that these contact records are being created! Any ideas what to check? Maybe there is some exposed form somewhere?
  
  **Tags:** contacts
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2024-02-01. Score: 2
  
  I found the answer: the /civicrm/mailing/subscribe page is allowing anonymous users to submit. I hadn't noticed that there is a "pending" status for the group subscription.
  
  > **Comments:**
  > **username_0**: Also, worth noting if anyone else has this issue, "Public" seems to default to actual public, and that may work for some situations. For us, we want public to any authenticated user, which is doable with Drupal permissions.  
  
  ---
  
  