Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass.
{ "cpes": [ "cpe:2.3:a:silverstripe:silverstripe:*:*:*:*:*:*:*:*" ], "severity": "Medium" }