In SilverStripe up to and including 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution.
silverstripe silverstripe