silverstripe/framework ChangePasswordForm does not check `Member::canLogIn()`
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-287.
Summary
After performing a password reset, `ChangePasswordForm::doChangePassword()` logs in the user without checking `Member::canLogIn()`. This presents an issue for sites that are using the extension point in that method to deny access to users (for example members that have not been “approved”, or members that have had their access revoked temporarily). It looks like `Member::canLogIn()` was originally designed to only be used for checking whether the user is locked out (due to too many incorrect login attempts) but has been opened up to other uses.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | silverstripe/framework (Packagist) | 3.1.19-rc1 to before 3.1.20 | 3.1.20 | Patch available | GHSA-p5h2-vr99-xm99 |
| — | silverstripe/framework (Packagist) | 3.2.4-rc1 to before 3.2.5 | 3.2.5 | Patch available | GHSA-p5h2-vr99-xm99 |
| — | silverstripe/framework (Packagist) | 3.3.2-rc1 to before 3.3.3 | 3.3.3 | Patch available | GHSA-p5h2-vr99-xm99 |
| — | silverstripe/framework (Packagist) | 3.4.0-rc1 to before 3.4.1 | 3.4.1 | Patch available | GHSA-p5h2-vr99-xm99 |
- silverstripe/framework (Packagist) Vendor— Affected 3.1.19-rc1 to before 3.1.20 Fixed in 3.1.20 Patch available GHSA-p5h2-vr99-xm99
- silverstripe/framework (Packagist) Vendor— Affected 3.2.4-rc1 to before 3.2.5 Fixed in 3.2.5 Patch available GHSA-p5h2-vr99-xm99
- silverstripe/framework (Packagist) Vendor— Affected 3.3.2-rc1 to before 3.3.3 Fixed in 3.3.3 Patch available GHSA-p5h2-vr99-xm99
- silverstripe/framework (Packagist) Vendor— Affected 3.4.0-rc1 to before 3.4.1 Fixed in 3.4.1 Patch available GHSA-p5h2-vr99-xm99
Remediation
- Fix · GHSA-p5h2-vr99-xm99 silverstripe/framework (Packagist) Fixed in 3.1.20 Advisory →
- Fix · GHSA-p5h2-vr99-xm99 silverstripe/framework (Packagist) Fixed in 3.2.5 Advisory →
- Fix · GHSA-p5h2-vr99-xm99 silverstripe/framework (Packagist) Fixed in 3.3.3 Advisory →
- Fix · GHSA-p5h2-vr99-xm99 silverstripe/framework (Packagist) Fixed in 3.4.1 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-p5h2-vr99-xm99
References
Other 7
- https://github.com/silverstripe/silverstripe-framework/commit/2b30ade44d333a4da4d13b31ffa28d0a34597442
- https://github.com/silverstripe/silverstripe-framework/commit/6606d986634f5b5dec16462acaa8d9a513c29fec
- https://github.com/silverstripe/silverstripe-framework/commit/6d41db77fa78f473db7bcff389456c980ef4e412
- https://github.com/silverstripe/silverstripe-framework/commit/782c18fd13b9fb92707d0ea3b231023204928297
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2016-011-1.yaml
- https://github.com/silverstripe/silverstripe-framework
- https://www.silverstripe.org/download/security-releases/ss-2016-011
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences