-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper privilege validation when checking user preferences for private discussion blocking. The key smoking gun is in Screener.php where the original implementation used $user->getPreference('blocksPd') which was replaced with direct attribute access $user->blocks_byobu_pd in the patch. This indicates the preference check was not properly accessing the user's actual blocking state pre-patch. The JavaScript changes show authorization logic consolidation but the root cause was in the PHP backend's incorrect preference handling.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| fof/byobu | composer | >= 0.3.0-beta.2, < 1.1.7 | 1.1.7 |
PHPPHPOngoing coverage of React2Shell