CVE-2021-28661: 
PHP vulnerability analysis and mitigation

Default SilverStripe GraphQL Server (aka silverstripe/graphql) versions 3.x through 3.4.1 contains a vulnerability where the permission checker is not inherited by query subclass. The vulnerability was discovered and disclosed on October 5, 2021, affecting the GraphQL server component of SilverStripe CMS (SilverStripe Advisory).

The vulnerability occurs because of a missing canView() check on data classes that utilize or inherit from the Read or ReadOne GraphQL 3 classes without explicitly assigning a service class to the permissionChecker property of their implementation. The issue has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (NVD).

On a default installation, this vulnerability can expose limited information (ID, FirstName, Surname) from the Member table that CMS users typically would not have access to. CMS users without limited permissions to view data may be able to access privileged information via the /admin/graphql endpoint (SilverStripe Advisory).

The vulnerability has been fixed in silverstripe/graphql versions ^3.5.2 and ^3.6.0. For cases where there is a legitimate use for an ItemQuery/ListQuery scaffolder class without a permission checker, users can implement a custom configuration in their app/_config/mysite.yml file to specify a NoCheckPermissionChecker (SilverStripe Advisory).