Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass.
{ "severity": "Medium", "cpes": [ "cpe:2.3:a:silverstripe:silverstripe:*:*:*:*:*:*:*:*" ] }