Read the docs
TI-2023-23907 Aliases CVE-2023-44401GHSA-jgph-w8rh-xf5p

Silverstripe GraqhQL's view permissions are bypassed for paginated lists of ORM data

Priority LOW 24CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

The Silverstripe CMS GraphQL Server serves Silverstripe data as GraphQL representations. In versions 4.0.0 prior to 4.3.7 and 5.0.0 prior to 5.1.3, `canView` permission checks are bypassed for ORM data in paginated GraphQL query results where the total number of records is greater than the number of records per page. Note that this also affects GraphQL queries which have a limit applied, even if the query isn’t paginated per se. This has been fixed in versions 4.3.7 and 5.1.3 by ensuring no new records are pulled in from the database after performing `canView` permission checks for each page of results. This may result in some pages in the query results having less than the maximum number of records per page even when there are more pages of results. This behavior is consistent with how pagination works in other areas of Silverstripe CMS, such as in `GridField`, and is a result of having to perform permission checks in PHP rather than in the database directly. One may disable these permission checks by disabling the `CanViewPermission` plugin.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00419 36th percentileScored 2026-11-07
Fix Fixed silverstripe-graphql (silverstripe): 4.3.7, 5.1.3silverstripe/graphql (Packagist): 4.3.7, 5.1.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
silverstripesilverstripe-graphql4.0.0 to before 4.3.7; 5.0.0 to before 5.1.34.3.7, 5.1.3Patch availableCNA
—silverstripe/graphql (Packagist)4.0.0 to before 4.3.74.3.7Patch availableGHSA-jgph-w8rh-xf5p
—silverstripe/graphql (Packagist)5.0.0 to before 5.1.35.1.3Patch availableGHSA-jgph-w8rh-xf5p
  • silverstripe-graphql Vendorsilverstripe Affected 4.0.0 to before 4.3.7; 5.0.0 to before 5.1.3 Fixed in 4.3.7, 5.1.3 Patch available CNA
  • silverstripe/graphql (Packagist) Vendor— Affected 4.0.0 to before 4.3.7 Fixed in 4.3.7 Patch available GHSA-jgph-w8rh-xf5p
  • silverstripe/graphql (Packagist) Vendor— Affected 5.0.0 to before 5.1.3 Fixed in 5.1.3 Patch available GHSA-jgph-w8rh-xf5p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:silverstripe:graphql:*:*:*:*:*:*:*:*4.0.0 to before 4.3.7; 5.0.0 to before 5.1.3Vulnerablesilverstripe
  • cpe:2.3:a:silverstripe:graphql:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.3.7; 5.0.0 to before 5.1.3 Vulnerable ·silverstripe

Remediation

  • Fix · CNA silverstripe-graphql (silverstripe) Fixed in 4.3.7, 5.1.3
  • Fix · GHSA-jgph-w8rh-xf5p silverstripe/graphql (Packagist) Fixed in 4.3.7 Advisory →
  • Fix · GHSA-jgph-w8rh-xf5p silverstripe/graphql (Packagist) Fixed in 5.1.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-44401
  2. 2026-10-03 Alias added: GHSA-jgph-w8rh-xf5p

References

Advisory 3

Other 2

  • TI-2023-12683 silverstripe/graphql Denial of Service vulnerability CVSS 3.1HIGH 7.5
  • TI-2023-21053 Denial of service vulnerability in silverstripe-graphql via recursive queries CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences