Any user (including an anonymous user) can bypass APIv4 permission checks with a specially crafted REST call.

Discussion: This is a variation of CIVI-SA-2026-35. The original fix for CIVI-SA-2026-35 was narrowly framed to minimize regression-risk; but this allowed similar bugs to remain in other code-paths. The new patch for CIVI-SA-2026-37 is more aggressive. Consequently, it closes off more variations on the bug.

If a user has access to APIv4 REST for purposes of creating/updating one kind of record (such as Contribution), then they may be able to infer implicit information from a related record-type (such as Contact), even if the user lacks regular access to the Contact.

This vulnerability arises from insufficient security checks in the "write/join" mechanism.

Any user (including an anonymous user) can bypass APIv4 permission checks with a specially crafted REST call.

The vulnerability arises from a discrepancy in how capitalization is handled by JSON, PHP arrays, and PHP methods.