-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| matrix-synapse | pip | < 0.31.2 | 0.31.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper authorization checks when a room lacks an m.room.power_levels event. The patch (0.31.2) changed the default required power level for state events from 0 to 50 in this scenario. This indicates the authorization logic in event_auth.py's auth rules was vulnerable, specifically in how it handled missing power_levels events. The function responsible for these checks would be where the default power level was incorrectly set to 0, allowing unauthorized access.