GHSA-9cw3-j7wg-jwj8
Neos Flow Information disclosure in entity security
GHSA-9cw3-j7wg-jwj8 is a medium vulnerability (CVSS 4.3) in neos/flow, published May 17, 2024. No source lists public exploit code. Fixed in neos/flow 3.0.12.
- Severity
- 4.3 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.0.12neos/flow +9 more
Description
If you had used entity security and wanted to secure entities not just based on the user's role, but on some property of the user (like the company he belongs to), entity security did not work properly together with the doctrine query cache. This could lead to other users re-using SQL queries from the cache which were built for other users; and thus users could see entities which were not destined for them.
Am I affected?
- Do you use Entity Security? if no, you are not affected.
- You disabled the Doctrine Cache (Flow_Persistence_Doctrine)? If this is the case, you are not affected.
- You use Entity Security in custom Flow or Neos applications. Read on.
- If you only used Entity Security based on roles (i.e. role A was allowed to see entities, but role B was denied): In this case, you are not affected.
- If you did more advanced stuff using Entity Security (like checking that a customer only sees his own orders; or a hotel only sees its own bookings), you very likely needed to register a custom global object in Neos.Flow.aop.globalObjects. In this case, you are affected by the issue; and need to implement the CacheAwareInterface in your global object for proper caching.
All Flow versions (starting in version 3.0, where Entity Security was introduced) were affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
neos/flowPackagist | 3.0.0 up to 3.0.12 | 3.0.12 |
neos/flowPackagist | 3.1.0 up to 3.1.10 | 3.1.10 |
neos/flowPackagist | 3.2.0 up to 3.2.13 | 3.2.13 |
neos/flowPackagist | 3.3.0 up to 3.3.13 | 3.3.13 |
neos/flowPackagist | 4.0.0 up to 4.0.6 | 4.0.6 |
neos/flowPackagist | 3.0.0 up to 3.0.12, plus listed versions 3.0.13.0.103.0.113.0.23.0.3 Show 6 moreShow less3.0.43.0.53.0.63.0.73.0.83.0.9 | 3.0.12 |
neos/flowPackagist | 3.1.0 up to 3.1.10, plus listed versions 3.1.13.1.23.1.33.1.43.1.5 Show 4 moreShow less3.1.63.1.73.1.83.1.9 | 3.1.10 |
neos/flowPackagist | 3.2.0 up to 3.2.13, plus listed versions 3.2.13.2.103.2.113.2.123.2.2 Show 7 moreShow less3.2.33.2.43.2.53.2.63.2.73.2.83.2.9 | 3.2.13 |
neos/flowPackagist | 3.3.0 up to 3.3.13, plus listed versions 3.3.13.3.103.3.113.3.123.3.2 Show 7 moreShow less3.3.33.3.43.3.53.3.63.3.73.3.83.3.9 | 3.3.13 |
neos/flowPackagist | 4.0.0 up to 4.0.6, plus listed versions 4.0.14.0.24.0.34.0.44.0.5 | 4.0.6 |
What each source reports
GitHub Advisories Score used
Neos Flow Information disclosure in entity security
If you had used entity security and wanted to secure entities not just based on the user's role, but on some property of the user (like the company he belongs to), entity security did not work properly together with the doctrine query cache. This could lead to other users re-using SQL queries from the cache which were built for other users; and thus users could see entities which were not destined for them.
Am I affected?
- Do you use Entity Security? if no, you are not affected.
- You disabled the Doctrine Cache (Flow_Persistence_Doctrine)? If this is the case, you are not affected.
- You use Entity Security in custom Flow or Neos applications. Read on.
- If you only used Entity Security based on roles (i.e. role A was allowed to see entities, but role B was denied): In this case, you are not affected.
- If you did more advanced stuff using Entity Security (like checking that a customer only sees his own orders; or a hotel only sees its own bookings), you very likely needed to register a custom global object in Neos.Flow.aop.globalObjects. In this case, you are affected by the issue; and need to implement the CacheAwareInterface in your global object for proper caching.
All Flow versions (starting in version 3.0, where Entity Security was introduced) were affected.
- Record
GHSA-9cw3-j7wg-jwj8- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSV
Neos Flow Information disclosure in entity security
If you had used entity security and wanted to secure entities not just based on the user's role, but on some property of the user (like the company he belongs to), entity security did not work properly together with the doctrine query cache. This could lead to other users re-using SQL queries from the cache which were built for other users; and thus users could see entities which were not destined for them.
Am I affected?
- Do you use Entity Security? if no, you are not affected.
- You disabled the Doctrine Cache (Flow_Persistence_Doctrine)? If this is the case, you are not affected.
- You use Entity Security in custom Flow or Neos applications. Read on.
- If you only used Entity Security based on roles (i.e. role A was allowed to see entities, but role B was denied): In this case, you are not affected.
- If you did more advanced stuff using Entity Security (like checking that a customer only sees his own orders; or a hotel only sees its own bookings), you very likely needed to register a custom global object in Neos.Flow.aop.globalObjects. In this case, you are affected by the issue; and need to implement the CacheAwareInterface in your global object for proper caching.
All Flow versions (starting in version 3.0, where Entity Security was introduced) were affected.
- Record
GHSA-9cw3-j7wg-jwj8- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.