-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/answerdev/answer | go | < 1.1.1 | 1.1.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: 1) Insecure default privilege configurations set during initialization (via initConfig), which allowed low-privileged actions (e.g., tag addition at rank=1). 2) Missing authorization checks in UpdatePrivilegesConfig, which could permit privilege escalation. The patch corrected defaults (e.g., rank.tag.add=1500) and introduced structured privilege selection, but did not explicitly add authorization middleware, leaving some uncertainty about UpdatePrivilegesConfig's security.