Read the docs
TI-2013-04086 Aliases CVE-2013-4661GHSA-7xcj-h49w-rxfw

CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based…

Priority LOW 24CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custom searches, which allows remote authenticated users with the "access CiviCRM" permission to bypass intended access restrictions, as demonstrated by accessing custom contribution data without having the "access CiviContribute" permission.

Why it matters now

EPSS 0.00992 62nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 67

CPEVersionsRoleVendor
cpe:2.3:a:civicrm:civicrm:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:2.0.2:*:*:*:*:*:*:*2.0.2VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:2.0.3:*:*:*:*:*:*:*2.0.3VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:2.0.4:*:*:*:*:*:*:*2.0.4VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:2.0.5:*:*:*:*:*:*:*2.0.5VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:2.0.6:*:*:*:*:*:*:*2.0.6VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:2.0.7:*:*:*:*:*:*:*2.0.7VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:2.1.1:*:*:*:*:*:*:*2.1.1VulnerableCiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.0.4:*:*:*:*:*:*:* Versions 2.0.4 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.0.5:*:*:*:*:*:*:* Versions 2.0.5 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.0.6:*:*:*:*:*:*:* Versions 2.0.6 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.0.7:*:*:*:*:*:*:* Versions 2.0.7 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·CiviCRM
Show 57 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:civicrm:civicrm:2.1.2:*:*:*:*:*:*:*2.1.2VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:2.1.4:*:*:*:*:*:*:*2.1.4VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:2.1.6:*:*:*:*:*:*:*2.1.6VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:2.2.1:*:*:*:*:*:*:*2.2.1VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:2.2.2:*:*:*:*:*:*:*2.2.2VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:2.2.3:*:*:*:*:*:*:*2.2.3VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:2.2.5:*:*:*:*:*:*:*2.2.5VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:2.2.6:*:*:*:*:*:*:*2.2.6VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:2.2.7:*:*:*:*:*:*:*2.2.7VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:2.2.8:*:*:*:*:*:*:*2.2.8VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:2.2.9:*:*:*:*:*:*:*2.2.9VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.0.1:*:*:*:*:*:*:*3.0.1VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.0.2:*:*:*:*:*:*:*3.0.2VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.0.3:*:*:*:*:*:*:*3.0.3VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.0.4:*:*:*:*:*:*:*3.0.4VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.1.2:*:*:*:*:*:*:*3.1.2VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.1.3:*:*:*:*:*:*:*3.1.3VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.1.4:*:*:*:*:*:*:*3.1.4VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.1.5:*:*:*:*:*:*:*3.1.5VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.1.6:*:*:*:*:*:*:*3.1.6VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.2.2:*:*:*:*:*:*:*3.2.2VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.2.3:*:*:*:*:*:*:*3.2.3VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.2.4:*:*:*:*:*:*:*3.2.4VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.2.5:*:*:*:*:*:*:*3.2.5VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.3.0:*:*:*:*:*:*:*3.3.0VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.3.1:*:*:*:*:*:*:*3.3.1VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.3.2:*:*:*:*:*:*:*3.3.2VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.3.3:*:*:*:*:*:*:*3.3.3VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.3.5:*:*:*:*:*:*:*3.3.5VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.3.6:*:*:*:*:*:*:*3.3.6VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:3.4.0:*:*:*:*:*:*:*3.4.0VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.0.5:*:*:*:*:*:*:*4.0.5VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.1.1:*:*:*:*:*:*:*4.1.1VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.1.2:*:*:*:*:*:*:*4.1.2VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.1.3:*:*:*:*:*:*:*4.1.3VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.1.4:*:*:*:*:*:*:*4.1.4VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.1.5:*:*:*:*:*:*:*4.1.5VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.1.6:*:*:*:*:*:*:*4.1.6VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.2.1:*:*:*:*:*:*:*4.2.1VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.2.2:*:*:*:*:*:*:*4.2.2VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.2.4:*:*:*:*:*:*:*4.2.4VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.2.5:*:*:*:*:*:*:*4.2.5VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.2.6:*:*:*:*:*:*:*4.2.6VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.2.7:*:*:*:*:*:*:*4.2.7VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.2.8:*:*:*:*:*:*:*4.2.8VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.2.9:*:*:*:*:*:*:*4.2.9VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.3.0:*:*:*:*:*:*:*4.3.0VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.3.1:*:*:*:*:*:*:*4.3.1VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.3.2:*:*:*:*:*:*:*4.3.2VulnerableCiviCRM
cpe:2.3:a:civicrm:civicrm:4.3.3:*:*:*:*:*:*:*4.3.3VulnerableCiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.1.4:*:*:*:*:*:*:* Versions 2.1.4 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.1.6:*:*:*:*:*:*:* Versions 2.1.6 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.2.5:*:*:*:*:*:*:* Versions 2.2.5 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.2.6:*:*:*:*:*:*:* Versions 2.2.6 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.2.7:*:*:*:*:*:*:* Versions 2.2.7 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.2.8:*:*:*:*:*:*:* Versions 2.2.8 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:2.2.9:*:*:*:*:*:*:* Versions 2.2.9 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.1.3:*:*:*:*:*:*:* Versions 3.1.3 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.1.4:*:*:*:*:*:*:* Versions 3.1.4 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.1.5:*:*:*:*:*:*:* Versions 3.1.5 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.1.6:*:*:*:*:*:*:* Versions 3.1.6 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.2.3:*:*:*:*:*:*:* Versions 3.2.3 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.2.4:*:*:*:*:*:*:* Versions 3.2.4 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.2.5:*:*:*:*:*:*:* Versions 3.2.5 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.3.0:*:*:*:*:*:*:* Versions 3.3.0 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.3.1:*:*:*:*:*:*:* Versions 3.3.1 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.3.2:*:*:*:*:*:*:* Versions 3.3.2 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.3.3:*:*:*:*:*:*:* Versions 3.3.3 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.3.5:*:*:*:*:*:*:* Versions 3.3.5 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.3.6:*:*:*:*:*:*:* Versions 3.3.6 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:3.4.0:*:*:*:*:*:*:* Versions 3.4.0 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.0.5:*:*:*:*:*:*:* Versions 4.0.5 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.1.2:*:*:*:*:*:*:* Versions 4.1.2 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.1.3:*:*:*:*:*:*:* Versions 4.1.3 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.1.4:*:*:*:*:*:*:* Versions 4.1.4 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.1.5:*:*:*:*:*:*:* Versions 4.1.5 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.1.6:*:*:*:*:*:*:* Versions 4.1.6 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.2.2:*:*:*:*:*:*:* Versions 4.2.2 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.2.4:*:*:*:*:*:*:* Versions 4.2.4 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.2.5:*:*:*:*:*:*:* Versions 4.2.5 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.2.6:*:*:*:*:*:*:* Versions 4.2.6 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.2.7:*:*:*:*:*:*:* Versions 4.2.7 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.2.8:*:*:*:*:*:*:* Versions 4.2.8 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.2.9:*:*:*:*:*:*:* Versions 4.2.9 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.3.0:*:*:*:*:*:*:* Versions 4.3.0 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.3.1:*:*:*:*:*:*:* Versions 4.3.1 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.3.2:*:*:*:*:*:*:* Versions 4.3.2 Vulnerable ·CiviCRM
  • cpe:2.3:a:civicrm:civicrm:4.3.3:*:*:*:*:*:*:* Versions 4.3.3 Vulnerable ·CiviCRM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-4661
  2. 2026-10-03 Alias added: GHSA-7xcj-h49w-rxfw

References

Advisory 2

Other 1

  • TI-2025-40285 A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the… CVSS 3.1MEDIUM 6.1
  • TI-2023-10751 Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM… CVSS 3.1MEDIUM 5.4
  • TI-2018-16163 PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in… CVSS 3.0CRITICAL 9.8
  • TI-2020-18643 In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to… CVSS 3.1HIGH 8.8
  • TI-2013-05077 Multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php in CiviCRM… CVSS 2.0HIGH 7.5
  • TI-2013-04087 The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote… CVSS 2.0MEDIUM 6.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences