How do I find more information about the ACL regression introduced in 4.6.7?
I've posted an advisory now: CIVI-SA-2015-008: Access bypass in CiviCRM 4.6.7

CiviCRM 4.6.7 introduced an access bypass issue which applied a limited number of sites.
The issue affected only certain configurations, where the site used ACLs to limit access, and applied to users whose permissions included “access CiviCRM” and “view my contact” but not “view all contacts”. Changes introduced in CRM-16512 allowed the “view my contact” permission for those users to incorrectly grant access to all contacts.
This issue is mitigated by the fact that only sites so configured are affected, but for sites affected the potential severity led us to make an out of schedule security release.


If your users with &quot;access CiviCRM&quot; also have access to all contacts (many smaller sites), you are not affected
If you are not using ACL functionality, you are not affected
If you did not upgrade to 4.6.7, you are not affected (but you should check you have applied the security fixes in that version!)