CVE-2020-6165

CVE-2020-6165 affects SilverStripe 4.5.0 (notably silverstripe/recipe-cms). The root cause is an incomplete permission check in the silverstripe/graphql module that can allow authenticated users to read records that should be excluded from results, particularly when lists are limited (e.g., by pa...

CVE-2020-6165: Limited queries break CanViewPermissionChecker

More info at https://www.silverstripe.org/download/security-releases/cve-2020-6165...