CiviCRM 4.6.7 introduced an access bypass issue which applied a limited number of sites.
The issue affected only certain configurations, where the site used ACLs to limit access, and applied to users whose permissions included “access CiviCRM” and “view my contact” but not “view all contacts”. Changes introduced in CRM-16512 allowed the “view my contact” permission for those users to incorrectly grant access to all contacts.
This issue is mitigated by the fact that only sites so configured are affected, but for sites affected the potential severity led us to make an out of schedule security release.
CiviCRM 4.6.7 (only)
CiviCRM 4.6.8+
The solution is to upgrade to CiviCRM 4.6.8. The same change was not applied to the 4.4 branch, so sites using 4.4 were not affected and need not upgrade.
The issue was identified and resolved by Eileen McNaughton.
https://issues.civicrm.org/jira/browse/CRM-16512
