Unscored severity · published Jan 29, 2014
CVE-2013-4661
CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custom searches, which allows remote…
–
CVSS
1%
EPSS
No
On KEV
Description
CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custom searches, which allows remote authenticated users with the "access CiviCRM" permission to bypass intended access restrictions, as demonstrated by accessing custom contribution data without having the "access CiviContribute" permission.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
Civicrm · Civicrm
2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4661
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4661
Vendor Advisory
http://civicrm.org/advisory/civi-sa-2013-003
Vendor Advisory
http://civicrm.org/advisory/civi-sa-2013-003-custom-search-permissions
issues.civicrm.org
http://issues.civicrm.org/jira/browse/CRM-12747
More from Civicrm
9.8
CVE-2018-1999022
PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate method,…
8.8
CVE-2026-72558
CiviCRM CiviCRM - SQL Injection
8.8
CVE-2020-36388
In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive
6.1
CVE-2025-65187
A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field
5.4
CVE-2023-25440
Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field