Flow Bugfix Releases for Entity Security
If you had used entity security and wanted to secure entities not just based on the user's role, but on some property of the user (like the company he belongs to), entity security did not work properly together with the doctrine query cache. This could lead to other users re-using SQL queries from the cache which were built for other users; and thus users could see entities which were not destined for them.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | typo3/flow | >= 3.0.0, < 3.0.12, >= 3.1.0, < 3.1.10, >= 3.2.0, < 3.2.13, >= 3.3.0, < 3.3.13, >= 4.0.0, < 4.0.6 | 3.0.12, 3.1.10, 3.2.13, 3.3.13, 4.0.6 |
References
- Weakness (CWE)
-- Platform
- Composer
- Package
typo3/flow- Disclosed
- 05.06.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-vh6j-wv25-8qxr - CC BY 4.0
Vulnerability history: typo3/flow
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 05.2022 06.2024
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 4
Disclosures per year
- 2022: 1
- 2023: 0
- 2024: 4
- 2025: 0
- 2026: 0
-
Flow Bugfix Releases for Entity Security this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.