CVE-2020-6165

SilverStripe 4.5.0 allows attackers to read certain records that should not have been placed into a result set. This affects silverstripe/recipe-cms. The automatic permission-checking mechanism in the silverstripe/graphql module does not provide complete protection against lists that are limited (e.g., through pagination), resulting in records that should have failed a permission check being added to the final result set. GraphQL endpoints are configured by default (e.g., for assets), but the admin/graphql endpoint is access protected by default. This limits the vulnerability to all authenticated users, including those with limited permissions (e.g., where viewing records exposed through admin/graphql requires administrator permissions). However, if custom GraphQL endpoints have been configured for a specific implementation (usually under /graphql), this vulnerability could also be exploited through unauthenticated requests. This vulnerability only applies to reading records; it does not allow unauthorised changing of records.

• CWE-276

• https://www.silverstripe.org/download/security-releases/CVE-2020-6165Vendor Advisory
• https://www.silverstripe.org/download/security-releases/CVE-2020-6165Vendor Advisory

Published

Jul 15, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-6157Opera Touch for iOS before version 2.4.5 is vulnerable to an…4.3
• CVE-2020-6158Opera Mini for Android before version 52.2 is vulnerable to …4.7
• CVE-2020-6159URLs using “javascript:” have the protocol removed when past…6.1
• CVE-2020-6162An issue was discovered in Bftpd 5.3. Under certain circumst…9.1
• CVE-2020-6163The WikibaseMediaInfo extension 1.35 for MediaWiki allows XS…6.1
• CVE-2020-6164In SilverStripe through 4.5.0, a specific URL path configure…7.5
• CVE-2020-6166A flaw in the WordPress plugin, Minimal Coming Soon & Mainte…5.4
• CVE-2020-6167A flaw in the WordPress plugin, Minimal Coming Soon & Mainte…8.8
• CVE-2020-6168A flaw in the WordPress plugin, Minimal Coming Soon & Mainte…7.6
• CVE-2020-6170An authentication bypass vulnerability on Genexis Platinum-4…9.8
• CVE-2020-6171A cross-site scripting (XSS) vulnerability in the index page…6.1
• CVE-2020-6173TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows U…5.3