-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/usememos/memos | go | < 0.9.1 | 0.9.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from missing explicit ownership validation in multiple CRUD handlers. The patch added critical security checks comparing resource.creator_id with the authenticated user's ID after object retrieval, rather than relying solely on query parameters. This pattern appears consistently across memo, resource, and shortcut handlers. The vulnerability allowed privilege escalation by manipulating object IDs without proper access control.