-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/usememos/memos | go | <= 0.9.0 | 0.9.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from endpoints accepting user-controlled resource identifiers (memo IDs, resource IDs, etc.) without verifying the requesting user had ownership rights. The commit patched this by: 1) Removing CreatorID from JSON bindings to prevent injection, 2) Adding post-retrieval ownership checks after fetching the resource by ID, and 3) Restructuring handlers to enforce creator validation. Key vulnerable patterns were in CRUD operations where user-controlled keys were trusted without subsequent authorization checks.