GHSA-wvvp-jwf5-qcpc: TYPO3 Information Disclosure in Page Tree

The vulnerability stems from improper access control in the page tree rendering mechanism. The PageTreeRepository::getTreeData method is responsible for fetching and constructing the page tree structure displayed in the backend. In affected versions, this function likely failed to properly integrate backend user permissions checks when retrieving page nodes, resulting in pages being visible to users without read access. The fix in v9.5.6 would have added proper permission checks (likely using TYPO3's PagePermission system) during tree data retrieval. The confidence is high because this component is directly responsible for page tree presentation and matches the described vulnerability pattern of missing authorization checks in tree rendering.