-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from pagination logic that fetches database records before fully applying PHP-level canView permission checks. The PaginationPlugin's result processing likely used naive offset/limit SQL queries, then filtered results in PHP without adjusting the pagination window for removed items. DataList::limit is implicated because ORM-level limit clauses would execute before permission filtering, creating a mismatch between SQL offsets and post-filtered results. The high confidence for PaginationPlugin comes from its direct responsibility for GraphQL pagination behavior, while DataList::limit has medium confidence due to being a lower-level ORM component.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| silverstripe/graphql | composer | >= 4.0.0, < 4.3.7 | 4.3.7 |
| silverstripe/graphql | composer | >= 5.0.0, < 5.1.3 | 5.1.3 |