-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| matrix-synapse | pip | < 1.95.1 | 1.95.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from missing user ownership checks in federation request handlers. The commit patches explicitly add UserID validation using hs.is_mine() in these three functions to prevent querying device information for remote users. The functions handle federation API endpoints for device/key management and were vulnerable because they previously processed requests without verifying if the target user belonged to the local homeserver, enabling information leakage about remote users.
Ongoing coverage of React2Shell