Incorrect authorization in SilverStripe Framework - CVE-2026-91112
Published: November 6, 2026
Vulnerability identifier: #VU159835
CSH Severity: Low
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-91112
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged attacker to escalate their own privileges to administrator in SilverStripe Framework.
The vulnerability exists due to insufficient authorization checks in the Security section when editing groups that grant ADMIN through a role or parent group. A low-privileged attacker can use CMS_ACCESS_SecurityAdmin access, without already having ADMIN permission, to edit such a group and obtain administrator privileges.
Affected software
SilverStripe Framework
How to mitigate CVE-2026-91112
Install security update from vendor's website.
SilverStripe Framework - update to 6.2.13