-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| wallabag/wallabag | composer | >= 2.0.0-beta.1, < 2.5.3 | 2.5.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing authorization checks in PUT/DELETE handlers. Pre-patch code used Sensio's ParamConverter to automatically fetch Annotation entities by ID without verifying user ownership. This allowed ID enumeration attacks. The commit replaced ParamConverter usage with explicit repository calls (findOneByIdAndUserId) in both methods, and added a validateAnnotation helper to enforce ownership. The vulnerable functions were directly handling requests without these checks, enabling cross-user modifications/deletions and information disclosure through error discrepancies.
A Semantic Attack on Google Gemini - Read the Latest Research