GHSA-VH6J-WV25-8QXR Flow Bugfix Releases for Entity Security

If you had used entity security and wanted to secure entities not just based on the user's role, but on some property of the user like the company he belongs to, entity security did not work properly together with the doctrine query cache. This could lead to other users re-using SQL queries from...

PT-2024-40478

Name of the Vulnerable Software and Affected Versions Entity security affected versions not specified Description The issue concerns entity security not working properly with the doctrine query cache when securing entities based on user properties, such as the company a user belongs to. This coul...

Information Disclosure

neos/flow is vulnerable to Information Disclosure. The vulnerability is due to entity security not properly integrating with the doctrine query cache, allowing users to reuse cached SQL queries built for other users based on their roles rather than their specific properties, potentially revealing...

GHSA-9CW3-J7WG-JWJ8 Neos Flow Information disclosure in entity security

If you had used entity security and wanted to secure entities not just based on the user's role, but on some property of the user like the company he belongs to, entity security did not work properly together with the doctrine query cache. This could lead to other users re-using SQL queries from...

PT-2024-40222

Name of the Vulnerable Software and Affected Versions: Neos Flow versions 3.0 and later Description: The issue arises when using entity security to secure entities based on user properties, such as the company they belong to, in combination with the doctrine query cache. This could lead to other...