-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 3.6, < 3.6.4 | 3.6.4 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing authorization checks in the message fetching web service. The commit diff shows the critical addition of a membership check using \core_message\api::is_user_in_conversation() in get_conversation_messages(). Prior to this fix, the function only checked general messaging permissions but didn't validate conversation membership, enabling unauthorized access. The added test case test_get_conversation_messages_as_user_not_in_conversation explicitly verifies this security boundary was missing in vulnerable versions.