-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| apache-superset | pip | <= 2.1.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two API endpoints in the Database REST API that were protected by can_read instead of can_write permissions. The GitHub PR #24185 specifically shows these endpoints had their permission requirements upgraded from can_read to can_write. Since Gamma users typically have read permissions, this improper default allowed them to execute connection testing and parameter validation - sensitive operations that should require write-level privileges. The file path is inferred from standard Superset API structure and endpoint naming conventions.
Ongoing coverage of React2Shell