UpHeron
All vulnerabilities

Servers and applications

CVE-2026-91114

Stored XSS via unescaped permission in PermissionCheckboxSetField

Severity
Medium 4.4
Published
29 Oct 2026
Last changed
29 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
6.2.13
Also known as
GHSA-232j-24c2-m823
Sources
Project advisories (GitHub)

Affected software

SoftwareAffected versions
Silverstripe CMSServers and applications · github:silverstripe/silverstripe-framework
  • Every version before 6.2.13

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-91114
  • GitHub Advisory Database https://github.com/advisories/GHSA-232j-24c2-m823
  • github.com https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-232j-24c2-m823