CIVI-SA-2026-37: Additional Permission Bypass in APIv4

Any user (including an anonymous user) can bypass APIv4 permission checks with a specially crafted REST call.

Discussion: This is a variation of CIVI-SA-2026-35. The original fix for CIVI-SA-2026-35 was narrowly framed to minimize regression-risk; but this allowed similar bugs to remain in other code-paths. The new patch for CIVI-SA-2026-37 is more aggressive. Consequently, it closes off more variations on the bug.

Regression Risk: In the new versions of CiviCRM, APIv4 will treat more properties as case-sensitive. Please note:

• This conforms with the general-practice in APIv4. Many properties and development tools already treat APIv4 as case-sensitive.
• However, it is possible that some third-party callers may have included honest typos which relied on the old behavior. Any such callers will need to be fixed on a case-by-case basis.