-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from two primary flaws: 1) Missing authorization checks in handler functions that failed to verify user ownership before performing sensitive operations. 2) Insecure deserialization of CreatorID fields in API models that allowed request manipulation. The patch added explicit ownership checks after resource retrieval (e.g., memo.CreatorID != userID) and removed CreatorID from JSON bindings to prevent injection. The combination of these flaws enabled attackers to modify critical user attributes and associated resources through parameter manipulation and missing access control.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/usememos/memos | go | <= 0.9.0 | 0.9.1 |