There has been a security release for CiviCRM. Upgrades are available for:
- CiviCRM v6.19.3 (download, release notes)
- CiviCRM v6.16 ESR (info, download, release notes)
These upgrades address the following security issues:
- CIVI-SA-2026-38: APIv4 - Information Disclosure via Joined Writes
- CIVI-SA-2026-39: Standalone - Cookie Security Downgrade
- CIVI-SA-2026-40: Groups - Access Bypass for Reserved Groups
- CIVI-SA-2026-41: APIv4 - Access Bypass via EntitySet API
- CIVI-SA-2026-42: Standalone - Privilege Escalation via User API
- CIVI-SA-2026-43: APIv4 - ACL Bypass via Join
- CIVI-SA-2026-44: APIv3 - SQLI in RLIKE Operator
- CIVI-SA-2026-45: Backend Record Stealing
- CIVI-SA-2026-46: Frontend Record Stealing
- CIVI-SA-2026-47: CiviEvent - Session Overwrite via Confirmation Screen
- CIVI-SA-2026-48: API - Access Bypass for Certain Billing Details
- CIVI-SA-2026-49: AJAX - Multiple Vulnerabilities
- CIVI-SA-2026-50: Standalone - MFA Bypass
- CIVI-SA-2026-51: CiviContribute - ACL Bypass in Financial Entities
- CIVI-SA-2026-52: Permissions - Erroneous Short-Circuit
Learn more about subscribing to Extended Security Releases (ESR).
Note for Drupal 9/10/11/12 builds
Due to the patching of the phpspreadsheet package for this release you may need to add to your root composer.json the following in the config section. Also for the civicrm-core package system admins should reference the 6.19.3.1 tagged release as that loosens the specific version requirement for phpspreadsheet package
"audit": {
"ignore": {
"PKSA-r15m-kszr-8n8q": "manually patched",
"PKSA-dxd5-wy68-pq29": "manually patched",
"PKSA-96jv-mtjg-g2v8": "manually patched",
"PKSA-zb3c-6qhx-m249": "manually patched"
}
}The CiviCRM Security Team would also like to advise that for systems that use the following extensions there have been security upgrades published:
- CKeditor5 - Fixed Version 1.8
- Summernote - Fixed version 1.6.3
Support CiviCRM
We are committed to keeping CiviCRM free and open, forever. We depend on your support to help make that happen.
- Make a donation or contribute to a Make it happen campaign.
- If your organization wants to support our work, please become a member today.
- If you are a CiviCRM service provider, please become a partner.
CiviCRM is community driven and is sustained through contributions, good vibes, solidarity, and financial support from its community. Help CiviCRM do a world of good.
