Skip to main content

This site requires you to update your browser. Your browsing experience maybe affected by not having the most up to date version.

CVE-2026-91114 Stored XSS via unescaped permission in PermissionCheckboxSetField

CVE-2026-91114 Stored XSS via unescaped permission in PermissionCheckboxSetField

Severity:
Medium (?)
Identifier:
CVE-2026-91114
Versions Affected:
silverstripe/framework: < 6.2.13
Versions Fixed:
silverstripe/framework: 6.2.13
Release Date:
2026-10-28

PermissionCheckboxSetField saved permission codes that the field did not offer, and rendered permission codes without escaping them. A user with access to the Security section could use this to store content that runs JavaScript in the browser of another user.

Base CVSS: 4.4
Reported by: Lachlan Davidson, Carapace