Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/silverstripe/graphql@4.0.0-alpha2
purl pkg:composer/silverstripe/graphql@4.0.0-alpha2
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-ajga-3b99-yugh Authentication bypass in SilverStripe GraphQL The GraphQL module accepts basic-auth as an authentication method by default. This can be used to bypass MFA authentication if the silverstripe/mfa module is installed, which is now a commonly installed module. A users password is still required though. Basic-auth has been removed as a default authentication method. If desired, it can be re-enabled by adding it to the authenticators key of a schema, or on SilverStripe\Graphql\Auth\Handler CVE-2020-26136
GHSA-mg2g-8pwj-r2j2

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-02T16:57:27.759554+00:00 GHSA Importer Fixing VCID-ajga-3b99-yugh https://github.com/advisories/GHSA-mg2g-8pwj-r2j2 38.1.0
2026-04-02T12:38:59.868376+00:00 GitLab Importer Fixing VCID-ajga-3b99-yugh https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/silverstripe/graphql/CVE-2020-26136.yml 38.0.0
2026-04-01T13:02:24.902056+00:00 GithubOSV Importer Fixing VCID-ajga-3b99-yugh https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-mg2g-8pwj-r2j2/GHSA-mg2g-8pwj-r2j2.json 38.0.0