CVE-2026-24749: CVE 2026 24749 Silverstripe Assets Grant True Defaultcve-2026-24749-cve-2026-24749-silverstripe-assets-grant-true-default
The method 'getURL' or 'getSourceURL' declares '$grant = true' as the default parameter value. This automatically grants session-based access to protected assets for any caller that omits the argument, bypassing file permission checks entirely. Change the default to '$grant = false' so that access grants are an explicit, opt-in decision by callers rather tha
