# CiviCRM 6.19.3

Released October 28, 2026

- **[Synopsis](#synopsis)**
- **[Security advisories](#security)**
- **[Credits](#credits)**
- **[Feedback](#feedback)**

## <a name="synopsis"></a>Synopsis

| *Does this version...?*                                         |          |
| --------------------------------------------------------------- | -------- |
| Change the database schema?                                     | no       |
| Alter the API?                                                  | no       |
| Require attention to configuration options?                     | no       |
| Fix problems installing or upgrading to a previous version?     | no       |
| Introduce features?                                             | no       |
| **Fix bugs?**                                                   | **yes**  |
| **Fix security vulnerabilities?**                               | **yes**  |

## <a name="security"></a>Security advisories

* **[CIVI-SA-2026-38](https://civicrm.org/advisory/civi-sa-2026-38): _APIv4_: Information Disclosure via Joined Writes (security/core#211: security/core#289)**
* **[CIVI-SA-2026-39](https://civicrm.org/advisory/civi-sa-2026-39): _Standalone_: Cookie Security Downgrade (security/core#192: security/core#296)**
* **[CIVI-SA-2026-40](https://civicrm.org/advisory/civi-sa-2026-40): _Groups_: Access Bypass for Reserved Groups (security/core#297)**
* **[CIVI-SA-2026-41](https://civicrm.org/advisory/civi-sa-2026-41): _APIv4_: Access Bypass via EntitySet API (security/core#199: security/core#300)**
* **[CIVI-SA-2026-42](https://civicrm.org/advisory/civi-sa-2026-42): _Standalone_: Privilege Escalation via User API (security/core#196: security/core#299)**
* **[CIVI-SA-2026-43](https://civicrm.org/advisory/civi-sa-2026-43): _APIv4_: ACL Bypass via Join (security/core#202: security/core#302)**
* **[CIVI-SA-2026-44](https://civicrm.org/advisory/civi-sa-2026-44): _APIv3_: SQLI in RLIKE Operator (security/core#307)**
* **[CIVI-SA-2026-45](https://civicrm.org/advisory/civi-sa-2026-45): Backend Record Stealing (security/core#203: security/core#304, security/core#305)**
* **[CIVI-SA-2026-46](https://civicrm.org/advisory/civi-sa-2026-46): Frontend Record Stealing (security/core#197: security/core#303)**
* **[CIVI-SA-2026-47](https://civicrm.org/advisory/civi-sa-2026-47): _CiviEvent_: Session Overwrite via Confirmation Screen (security/core#206: security/core#310)**
* **[CIVI-SA-2026-48](https://civicrm.org/advisory/civi-sa-2026-48): _API_: Access Bypass for Certain Billing Details (security/core#194: security/core#298)**
* **[CIVI-SA-2026-49](https://civicrm.org/advisory/civi-sa-2026-49): _AJAX_: Multiple Vulnerabilities (security/core#205: security/core#309, security/core#338)**
* **[CIVI-SA-2026-50](https://civicrm.org/advisory/civi-sa-2026-50): _Standalone_: MFA Bypass (security/core#148: security/core#246)**
* **[CIVI-SA-2026-51](https://civicrm.org/advisory/civi-sa-2026-51): _CiviContribute_: ACL Bypass in Financial Entities (security/core#283: security/core#283)**
* **[CIVI-SA-2026-52](https://civicrm.org/advisory/civi-sa-2026-52): _Permissions_: Erroneous Short-Circuit (security/core#336)**

## <a name="bugs"></a>Bugs resolved

* **_CustomGroup_: Fix Custom Groups created in upgrade triggering no table ([#37719](https://github.com/civicrm/civicrm-core/pull/37719))**
* **_CustomGroup_: Fix no such table error in rebuild ([#37718](https://github.com/civicrm/civicrm-core/pull/37718))**
* **_Riverlea_: Fix css not being applied due to syntax error ([#37715](https://github.com/civicrm/civicrm-core/pull/37715))**
* **_CiviContribute_: Ensure that contribution widget is enabled before outputting data ([#37708](https://github.com/civicrm/civicrm-core/pull/37708))**
* **_Manged Entities_: Fix too loose matching on Option Value / Search Display managed entities [[#37681](https://github.com/civicrm/civicrm-core/pull/37681): [#37679](https://github.com/civicrm/civicrm-core/pull/37679))**

## <a name="credits"></a>Credits

This release was developed by the following authors and reviewers:

CiviCRM Core Team - Coleman Watts, Tim Otten; John Kingsnorth; Benjamin W; Non Profit Tech
Advisor - Brian Flett; enCircle Solutions Ltd - Darren Woods; Dave D; Jakub Fidler; James
Newey; civico GmbH - Johannes Filter; John Kingsnorth; Tadpole Collective - Kevin
Cristiano; Fuzion - Luke Stewart; civiservice.de - Martin Correll; Greenpeace Central and
Eastern Europe - Patrick Figel; Artful Robot - Rich Lott; BrightMinded Ltd - Bradley Taylor;

## <a name="feedback"></a>Feedback

These security release-notes are edited by Tim Otten.  If you'd like to provide
feedback on them, please report an issue at https://lab.civicrm.org/dev/release/.