1. Home
  2. Security Advisories

CIVI-SA-2026-03: Standalone - Extraneous Staff Permission

Published
2026-03-18 12:00
Written by
dev-team

Installations of CiviCRM (Standalone) include these default roles: "Everyone", "Administrator", and "Staff".

Previously, the default "Staff" role included permission to administer users. However, this is a powerful permission. Many systems should treat this as this as an "Administrator" permission.

  • Going forward, new deployments will not grant administer users to "Staff" by default.
  • For existing deployments, the original configuration remains. You should consider whether you want to retain or remove this permission. (For removal instructions, see below.)
Security Risk
Critical
Vulnerability
Other
Affected Versions

CiviCRM v5.74.0 - v6.12.0 (Standalone only)

Fixed Versions

CiviCRM v6.12.1, v6.10.3 (ESR), and later (Standalone only)

Publication Date
Solutions

This fix does not require an upgrade. Follow ALL these steps:

  1. Navigate to "Administer => Users and Permissions => User Roles".
  2. Find the "Staff" role. In the drilldown menu, right-click "Edit" and open in a new window.
  3. Use the browser to search the web-page ("Find in Page" or Ctrl-F or Cmd-F). Look for "Administer user accounts". If you find it, remove it.
  4. Save.
Credits

Lassi (lassitemp@proton.me), Seamus Lee (JMA Consulting), Tim Otten (CiviCRM), Benjamin W, Rich Lott (Artful Robot), Luke Stewart (Fuzion)