Skip to main content

This site requires you to update your browser. Your browsing experience maybe affected by not having the most up to date version.

CVE-2026-91112 CMS_ACCESS_SecurityAdmin privilege escalation

CVE-2026-91112 CMS_ACCESS_SecurityAdmin privilege escalation

Severity:
Medium (?)
Identifier:
CVE-2026-91112
Versions Affected:
silverstripe/framework: < 6.2.13
Versions Fixed:
silverstripe/framework: 6.2.13
Release Date:
2026-10-28

A user with access to the Security section (CMS_ACCESS_SecurityAdmin) but without the ADMIN permission could edit a group that grants ADMIN through a role or a parent group, and use it to escalate their own privileges.

Base CVSS: 6.8
Reported by: Lachlan Davidson, Carapace