-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/gravitl/netmaker | go | < 0.17.1 | 0.17.1 |
| github.com/gravitl/netmaker | go | >= 0.18.0, < 0.18.6 | 0.18.6 |
Miggo AIRoot Cause AnalysisThe vulnerability is a mass assignment issue (CWE-915) allowing privilege escalation. In Go web applications, this typically occurs in user update/create handlers that bind request data directly to user models without field filtering. The high-confidence 'UpdateUser' function would be responsible for processing user profile updates, where a missing allowlist of editable fields could let attackers modify admin privileges. The medium-confidence 'CreateUser' is included as secondary vector, though the primary impact appears in update operations. Without commit diffs, this assessment is based on standard patterns for this CWE and the described privilege escalation impact.
GoGoOngoing coverage of React2Shell