-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sentry | pip | >= 22.1.0, < 23.7.2 | 23.7.2 |
Miggo AIRoot Cause AnalysisThe core vulnerability stemmed from ApiTokensEndpoint using SessionAuthentication which didn't properly restrict access to session cookies only. The patch introduced SessionNoAuthTokenAuthentication which explicitly blocks requests with Authorization headers (token-based auth). The original implementation allowed any authenticated request (including token-authenticated ones) to access the token listing endpoint, violating proper scope-based access control.
Ongoing coverage of React2Shell