Skip to main content

This site requires you to update your browser. Your browsing experience maybe affected by not having the most up to date version.

CVE-2026-88989 Auth bypass GridFieldDetailForm

CVE-2026-88989 Auth bypass GridFieldDetailForm

Severity:
Medium (?)
Identifier:
CVE-2026-88989
Versions Affected:
silverstripe/framework: < 6.2.13
Versions Fixed:
silverstripe/framework: 6.2.13
Release Date:
2026-10-28

A CMS user who can edit records through a GridField detail form could create new records without the permission to create them, by sending a save request directly.

Base CVSS: 4.3
Reported by: HDWSec - https://hdwsec.fr