-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pixelfed/pixelfed | composer | <= 0.11.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing authorization checks in the bookmark creation flow. The patch adds two critical security checks: 1) Verifying the post scope is valid, and 2) For private posts, ensuring the user either owns the post or follows the author. The vulnerable version (<=0.11.4) lacked these checks in the BookmarkController::store method, allowing unauthorized users to bookmark (and thus view) private posts by directly calling the bookmark endpoint with a private post ID. The commit diff clearly shows these security checks were added to this specific controller method.
A Semantic Attack on Google Gemini - Read the Latest Research