CVE-2026-24749: CVE 2026 24749 Silverstripe Assets Grant True Default
The method 'getURL' or 'getSourceURL' declares '$grant = true' as the default parameter value. This automatically grants session-based access to protected assets for any caller that omits the argument, bypassing file permission checks entirely. Change the default to '$grant = false' so that access grants are an explicit, opt-in decision by callers rather tha
PHPgreprules fetch cve-2026-24749-cve-2026-24749-silverstripe-assets-grant-true-default --engine opengrepDescription
The method 'getURL' or 'getSourceURL' declares '$grant = true' as the default parameter value. This automatically grants session-based access to protected assets for any caller that omits the argument, bypassing file permission checks entirely. Change the default to '$grant = false' so that access grants are an explicit, opt-in decision by callers rather tha
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.