Flow Bugfix Releases for Entity Security
Priority LOW 38Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
If you had used entity security and wanted to secure entities not just based on the user's role, but on some property of the user (like the company he belongs to), entity security did not work properly together with the doctrine query cache. This could lead to other users re-using SQL queries from the cache which were built for other users; and thus users could see entities which were not destined for them.
Why it matters now
Fix Fixed typo3/flow (Packagist): 3.0.12, 3.1.10, 3.2.13 +2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | typo3/flow (Packagist) | 3.0.0 to before 3.0.12 | 3.0.12 | Patch available | GHSA-vh6j-wv25-8qxr |
| — | typo3/flow (Packagist) | 3.1.0 to before 3.1.10 | 3.1.10 | Patch available | GHSA-vh6j-wv25-8qxr |
| — | typo3/flow (Packagist) | 3.2.0 to before 3.2.13 | 3.2.13 | Patch available | GHSA-vh6j-wv25-8qxr |
| — | typo3/flow (Packagist) | 3.3.0 to before 3.3.13 | 3.3.13 | Patch available | GHSA-vh6j-wv25-8qxr |
| — | typo3/flow (Packagist) | 4.0.0 to before 4.0.6 | 4.0.6 | Patch available | GHSA-vh6j-wv25-8qxr |
- typo3/flow (Packagist) Vendor— Affected 3.0.0 to before 3.0.12 Fixed in 3.0.12 Patch available GHSA-vh6j-wv25-8qxr
- typo3/flow (Packagist) Vendor— Affected 3.1.0 to before 3.1.10 Fixed in 3.1.10 Patch available GHSA-vh6j-wv25-8qxr
- typo3/flow (Packagist) Vendor— Affected 3.2.0 to before 3.2.13 Fixed in 3.2.13 Patch available GHSA-vh6j-wv25-8qxr
- typo3/flow (Packagist) Vendor— Affected 3.3.0 to before 3.3.13 Fixed in 3.3.13 Patch available GHSA-vh6j-wv25-8qxr
- typo3/flow (Packagist) Vendor— Affected 4.0.0 to before 4.0.6 Fixed in 4.0.6 Patch available GHSA-vh6j-wv25-8qxr
Remediation
- Fix · GHSA-vh6j-wv25-8qxr typo3/flow (Packagist) Fixed in 3.0.12 Advisory →
- Fix · GHSA-vh6j-wv25-8qxr typo3/flow (Packagist) Fixed in 3.1.10 Advisory →
- Fix · GHSA-vh6j-wv25-8qxr typo3/flow (Packagist) Fixed in 3.2.13 Advisory →
- Fix · GHSA-vh6j-wv25-8qxr typo3/flow (Packagist) Fixed in 3.3.13 Advisory →
- Fix · GHSA-vh6j-wv25-8qxr typo3/flow (Packagist) Fixed in 4.0.6 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-vh6j-wv25-8qxr
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences