-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 2.6.9 | 2.6.9 |
| moodle/moodle | composer | >= 2.7.0, < 2.7.6 | 2.7.6 |
| moodle/moodle | composer | >= 2.8.0, < 2.8.4 | 2.8.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from an insufficient authorization check in message/index.php. The original code used message_current_user_is_involved() combined with a capability check in a flawed logical structure (!A && !B). This allowed users who were neither conversation participants nor holders of the readallmessages capability to access private messages. The patch replaced this check with a direct validation of $currentuser status and capability, indicating message_current_user_is_involved() was a key component of the flawed authorization logic.
A Semantic Attack on Google Gemini - Read the Latest Research