-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| spree_auth_devise | rubygems | >= 1.0.0, < 3.0.5 | 3.0.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the User model's unsafe mass assignment configuration. The GitHub patch shows :spree_role_ids was explicitly removed from attr_accessible in app/models/spree/user.rb. Before the fix, this attribute whitelisting allowed arbitrary role assignment via user input. The commit message 'Remove Mass Assignment of Role IDs' and added controller logic to handle role assignment separately confirm the root cause was mass assignment via this model's attr_accessible declaration.