Missing Authorization in SilverStripe Framework - CVE-2026-88989
Published: November 6, 2026
Vulnerability identifier: #VU159833
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-88989
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated CMS user to create records in SilverStripe Framework without the required permission to create them.
The vulnerability exists due to missing creation permission checks in the GridField detail form when processing a directly submitted save request. An authenticated CMS user can exploit existing permission to edit records through that form to submit a save request and create unauthorized records.
Affected software
SilverStripe Framework
How to mitigate CVE-2026-88989
Install security update from vendor's website.
SilverStripe Framework - update to 6.2.13