-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| wagtail | pip | < 4.1.9 | 4.1.9 |
| wagtail | pip | >= 4.2.0, < 5.0.5 | 5.0.5 |
| wagtail | pip | >= 5.1.0, < 5.1.3 | 5.1.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insufficient permission checks in the UserBulkAction view. The patch added PermissionCheckedMixin and permission policy enforcement, indicating the original implementation didn't properly validate user permissions. This allowed authenticated low-privilege users to access the view, triggering error messages that leaked sensitive information through disclosure of user display names in error responses.