Skip to main content

This site requires you to update your browser. Your browsing experience maybe affected by not having the most up to date version.

CVE-2026-91113 User-controlled ClassName allows unauthorized record type change

CVE-2026-91113 User-controlled ClassName allows unauthorized record type change

Severity:
Medium (?)
Identifier:
CVE-2026-91113
Versions Affected:
silverstripe/framework: < 6.2.13
Versions Fixed:
silverstripe/framework: 6.2.13
Release Date:
2026-10-28

A user who can edit a record through a GridField detail form could change the record to an unrelated class, without the permission checks for that class.

Base CVSS: 4.3
Reported by: Lachlan Davidson, Carapace