-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/openfga/openfga | go | = 0.3.0 | 0.3.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing type restriction filters in relationship lookup functions. The GitHub PR #422 fix shows these functions were modified to add 'filter by allowed object type' logic. In v0.3.0, when checking relationships, these functions would return tuples valid under previous model versions without validating against current type restrictions, enabling authorization bypass when models were updated. The direct correlation between the vulnerability description (legacy tuples being honored after type restriction changes) and the patched code locations confirms these functions' role.
Ongoing coverage of React2Shell