-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| thorsten/phpmyfaq | composer | < 3.1.13 | 3.1.13 |
PHPPHPMiggo AIRoot Cause AnalysisThe core vulnerability stems from ajaxservice.php's update handler not verifying email ownership before processing changes. The patch added a critical check comparing the current user's ID with the email's owner ID via getUserIdByEmail(). The User.php function's return type fix (removing int cast) suggests potential type comparison issues exacerbated the vulnerability. Together, these created an insecure chain: 1) Missing ownership check in update flow, 2) Possible type mismatch in user ID comparison.
Ongoing coverage of React2Shell