-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability explicitly references the /desktop/api/users/autocomplete endpoint as the attack vector. In web frameworks, endpoints typically map directly to handler functions. The function serving this endpoint would be responsible for user autocomplete functionality, and its lack of authentication/authorization checks allows unauthorized user enumeration. While exact implementation details aren't provided, the endpoint structure and HUE's Python-based architecture strongly suggest a handler function in users.py with a name like users_autocomplete.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gethue | npm | <= 3.9.0 |