Elasticsearch: ACLs are not respected in search results #3519

New issue

Open

opened 2026-02-20 16:06:26 -05:00 by deekerman · 2 comments

deekerman commented

2026-02-20 16:06:26 -05:00

Owner

Originally created by @dawid-zaroda on GitHub (Jan 22, 2019).

Issue

When user haven't access to record, it will be still visible in search results from Elasticsearch, with all data shown on results list.

Expected Behavior

Displaying search result should respect ACLs and filter results if user shouldn't access them.

Actual Behavior

System doesn't filter results.

Steps to Reproduce

Create role with Owner on all possible rights for Accounts module (or Unset if Owner is no present)
Create new standard user and assign him created role
Create few accounts related to admin and to new user
Login as new user
Type name of account related to admin in global search box

Your Environment

SuiteCRM Version used: 7.11.0
Browser name and version: Google Chrome 71.0.3578.98 64-bit
Environment name and version: PHP 7.1, Elasticsearch 5.6.13
Operating System and version: Ubuntu 16.04.4

Originally created by @dawid-zaroda on GitHub (Jan 22, 2019).    #### Issue When user haven't access to record, it will be still visible in search results from Elasticsearch, with all data shown on results list. #### Expected Behavior Displaying search result should respect ACLs and filter results if user shouldn't access them. #### Actual Behavior System doesn't filter results. #### Steps to Reproduce 1. Create role with *Owner* on all possible rights for Accounts module (or Unset if Owner is no present) 2. Create new standard user and assign him created role 3. Create few accounts related to admin and to new user 4. Login as new user 5. Type name of account related to admin in global search box #### Your Environment  * SuiteCRM Version used: 7.11.0 * Browser name and version: Google Chrome 71.0.3578.98 64-bit * Environment name and version: PHP 7.1, Elasticsearch 5.6.13 * Operating System and version: Ubuntu 16.04.4

deekerman added the

Type: Bug

Priority:Important

Area: Elasticsearch

labels

2026-02-20 16:06:26 -05:00

deekerman commented

2026-02-20 16:06:27 -05:00

Author

Owner

@pgorod commented on GitHub (Jan 22, 2019):

It seems the same thing happens on Advanced Search:

https://suitecrm.com/suitecrm/forum/developer-help/21561-document-revisions-still-showing-in-global-search-although-documents-module-is-restricted

@pgorod commented on GitHub (Jan 22, 2019): It seems the same thing happens on Advanced Search: https://suitecrm.com/suitecrm/forum/developer-help/21561-document-revisions-still-showing-in-global-search-although-documents-module-is-restricted

deekerman commented

2026-02-20 16:06:27 -05:00

Author

Owner

@fosullivan-usam commented on GitHub (Apr 29, 2020):

I can confirm that this issue happens with ElasticSearch, even in SuiteCRM 7.11.13. It does NOT happen with Basic or Advanced searches.

Users in a Security Group with limited access to records can see all the ListView columns of all Accounts, Contacts, Opportunities, and Notes records. When they click on the name of any record, they are (correctly) presented with a page that says, "You do not have access to this area. Contact your site administrator to obtain access. Redirect to Home in 3 seconds"

I have had to turn-off ElasticSearch until this issue is fixed.

@fosullivan-usam commented on GitHub (Apr 29, 2020): I can confirm that this issue happens with ElasticSearch, even in SuiteCRM 7.11.13. It does NOT happen with Basic or Advanced searches. Users in a Security Group with limited access to records can see all the ListView columns of all Accounts, Contacts, Opportunities, and Notes records. When they click on the name of any record, they are (correctly) presented with a page that says, "You do not have access to this area. Contact your site administrator to obtain access. Redirect to Home in 3 seconds" I have had to turn-off ElasticSearch until this issue is fixed.