GHSA-xpff-c35g-j3cr silverstripe/framework Privilege Escalation Risk in Member Edit form

• Packagist silverstripe/framework: >= 3.5.7-rc1, < 3.5.8 → fixed in 3.5.8 • Packagist silverstripe/framework: >= 3.6.0-rc1, < 3.6.6 → fixed in 3.6.6 • Packagist silverstripe/framework: >= 4.0.0-rc1, < 4.0.4 → fixed in 4.0.4 • Packagist silverstripe/framework: >= 4.1.0-rc1, < 4.1.1 → fixed in 4.1.1

A member with the permission `EDIT_PERMISSIONS` and access to the "Security" section is able to re-assign themselves (or another member) to `ADMIN` level. CMS Fields for the member are constructed using DirectGroups instead of Groups relation which results in bypassing security logic preventing privilege escalation.