CIVI-SA-2020-09: Privilege Escalation via ACL Smart Groups

In CiviCRM, an Access Control List (ACL) confers limited access to contact records (based on the membership list for a "Group" of contacts). In configurations with "ACL Smart Groups", a flaw allowed limited backend users to re-define their group criteria and gain elevated access. The fix ensures that only trusted users (with permission "edit groups") may re-define the group criteria.

NOTE: If an organization uses ACLs, then groups are important to data security, so the permission "edit groups" implies significant trust. This model is suitable for relatively flat organizations in which *only* trusted users may create, edit, or delete groups.

Some organizations may need more tiered permissions - e.g. allowing a user to create, edit, redefine, or delete *some* groups but not *all* groups. Supporting this distinction requires a change in the security model, and CIVI-SA-2020-09 is only a patch-fix to the existing model. If you need a more nuanced model, then evaluate enhancements such as the Group Protect extension.