CiviCRM's qfKey protects against cross-site request-forgery (CSRF) attacks. The handling of the qfKey is weaker than expected.

Upgrade Note: The update changes the representation of the qfKey. If you apply the update at the same time that an active user is working with a web form, then the user may temporarily retain an old (invalid) qfKey. Their next form-submission may fail. However, this is quickly resolve by reloading the form (or navigating to any other form).

When embedding a saved-search in a custom form, administrators may pre-configure mandatory filter-criteria. In some cases, the mandatory criteria can be bypassed.

An authenticated user with permission to view file-attachments may be able to move/remove arbitrary files on the server.

Upgrade Note: This update constrains access to APIv4's File entity and the recently added option, move_file. The constraint parallels a similar constraint in APIv3's Attachment. To use the move_file option, you must invoke the API through a trusted channel (e.g. PHP-API) and set checkPermissions=>FALSE.

Some pop-up dialogs which include user-supplied titles may be vulnerable to cross-site scripting.

In the handling of Contact profile-images, there is a vulnerability to cross-site request forgery.

When submitting an invalid request, the request appears to be properly denied - but (in some cases) it still continues to execute.

This issue affects Drupal and Backdrop. It does not affect WordPress or Joomla. It may theoretically affect some versions of Standalone.