Any user (including an anonymous user) can bypass APIv4 permission checks with a specially crafted REST call.
Discussion: This is a variation of CIVI-SA-2026-35. The original fix for CIVI-SA-2026-35 was narrowly framed to minimize regression-risk; but this allowed similar bugs to remain in other code-paths. The new patch for CIVI-SA-2026-37 is more aggressive. Consequently, it closes off more variations on the bug.
Regression Risk: In the new versions of CiviCRM, APIv4 will treat more properties as case-sensitive. Please note:
- This conforms with the general-practice in APIv4. Many properties and development tools already treat APIv4 as case-sensitive.
- However, it is possible that some third-party callers may have included honest typos which relied on the old behavior. Any such callers will need to be fixed on a case-by-case basis.
Security Risk
Highly Critical
Vulnerability
Access Bypass
Affected Versions
CiviCRM v6.17.0 and earlier
Fixed Versions
CiviCRM v6.17.1, v6.16.5, v6.10.10 (ESR), and later
Publication Date
Solutions
Any ONE of the following will mitigate the vulnerability:
- Upgrade to a fixed version of CiviCRM, or...
- Install the extension "Hotfix: Camel Attack" via web UI or CLI, or...
- Apply the following patch
Credits
Coleman Watts - CiviCRM Core Team; John Kingsnorth
