-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/usememos/memos | go | < 0.9.0 | 0.9.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from structs used in PATCH endpoints having their ID fields exposed to JSON deserialization. Before the patch, these structs allowed clients to supply arbitrary IDs through API requests. The addition of json:"-" tags in the commit indicates these fields were improperly accepting user-controlled input for privileged operations, violating CWE-269 and CWE-648 by enabling ID manipulation for unauthorized access. All modified structs directly correspond to CRUD operations with privilege-sensitive resources.