CIVI-SA-2016-10: Insufficient permissions checking when editing own comment

Published
2016-06-01 14:26
Written by

An access bypass was identified where if a user was permitted only the "View own contact" permission in the CMS, they were also able to edit their own contact. This bypass of permissions checking did not extend to other contacts in CiviCRM.

Security Risk
Moderately Critical
Vulnerability
Access Bypass
Affected Versions

CiviCRM versions prior to 4.7.8 or 4.6.17

 

Fixed Versions

CiviCRM versions 4.7.8 or greater, or 4.6.17 or greater

 

Solutions
Credits

Gemma Potaka and Peter Davis of Fuzion NZ for reporting the issue.

Jitendra Purohit, Peter Davis and Monish Deb for collaborating on the testing and fix.

CVE
CIVI-SA-2016-10