CiviCRM permission-checks may incorporate a mix of boolean operations (AND and OR). In certain combinations, the permission-check has a premature short-circuit and grants access erroneously.

The issue is highly dependent on the specific boolean expression. It is believed that civicrm-core does not have any live, vulnerable expressions. However, extensions could have exploitable expressions.

It was possible to retrieve associated financial entities for contributions that were associated with contacts a user may not have been able to see

By default, CiviCRM Standalone accepts password credentials from all users -- for both web-based user-logins and REST-based service-logins.

CiviCRM Standalone also has an option for Multifactor Authentication (MFA), which provides defense-in-depth to limit the potency of a compromised password.

Prior to 6.19.3, MFA constrained password access for web-logins (all users) but not service-logins (all users). This could bypass the extra MFA checks. In 6.19.3, MFA blocks passwords for all service-logins.

CiviCRM web-pages must frequently make small requests for specific pieces of data (AJAX requests). Modern CiviCRM web-pages process these requests through an opinionated framework (APIv4 AJAX), but many pages use an older framework (basic/legacy AJAX).

Within the basic/legacy framework, there were multiple issues:

Permissions were not adequately checked for event billing locations, allowing location details associated with events (including non-public events) to be accessed publicly.

A malicious actor may provide a special link to a staff-user, which causes the user to quietly change their logged-in identity.

We have not found a way to use this issue to reveal private information or manipulate ordinary data records. However, it can lead to inaccurate audit-logs (and create general confusion).

CiviCRM "Form Builder" allows an administrator to define custom forms. Forms reference an initial data-record (such as an "Individual submission form"), and forms may reference related records (such Phone or Email).

If a form provides acccess to related records, then a form-user can steal related records. This reveals the content of the record, and it deprives the original owner of access.

In CiviCRM's data-model, there are several kinds of records which may be owned by a particular person. For example, if a user creates a custom SavedSearch, then the SavedSearch is owned by that user. CiviCRM allows the owner to revise their record, but it blocks access for most other users.