Installations of CiviCRM (Standalone) include these default roles: "Everyone", "Administrator", and "Staff".

Previously, the default "Staff" role included permission to administer users. However, this is a powerful permission. Many systems should treat this as this as an "Administrator" permission.

If two users share access to the same client device, then a Session Fixation vulnerability enables the first user to impersonate the second user.

A user with permission to manage File uploads via APIv4 can escalate to executing arbitrary PHP files.

The March 18 release includes updates to several security issues -- notably CIVI-SA-2026-09: Dropdown Options (XSS). Some updates could have side-effects for other screens which use Quickform widgets (in CiviCRM and third-party add-ons), so we want to explore this in more detail.

The helper function CRM_Utils_String::createRandom() relies on a "cryptographically weak" random number generator.

A "weak" generator appears random but can sometimes be predicted. The significance depends on the specific use-cases which call this helper.

The "Accounting Batch" interface is vulnerable to a cross-site scripting issue.

Exploiting this vulnerability requires permission create manual batch.