CIVI-SA-2026-45: Backend Record Stealing

In CiviCRM's data-model, there are several kinds of records which may be owned by a particular person. For example, if a user creates a custom SavedSearch, then the SavedSearch is owned by that user. CiviCRM allows the owner to revise their record, but it blocks access for most other users.

Multiple APIs and forms suffered record-stealing vulnerabilities, where another user could take away ownership of a record. This reveals the content of the record, and it deprives the original owner of access. Today's update is based on broad audit of ownership in APIv3, APIv4, and QuickForm. It includes a mix of generic and specific updates to prevent record-stealing.

Note: CIVI-SA-2026-45 (Backend) and CIVI-SA-2026-46 (Frontend) are similar, in that both deal with stealing records. However, they differ in important ways. The backend vulnerabilities affect many entities, but the attacker must have some baseline permissions (such as access CiviCRM or manage own search_kit). The frontend vulnerabilities can be exploited anonymously, but they only affect entities that are listed on a public form.