-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper role-based access control (RBAC) configuration rather than specific code functions. The root cause was the inclusion of the CONFIG_READ scope in the viewer and contributor role definitions (as class-level variables in RoleRegistryEnum), allowing lower-privileged users to access the sensitive config endpoint. The patch removed CONFIG_READ from these roles' scopes in src/fides/api/oauth/roles.py. While this configuration error created the vulnerability, there are no traditional 'functions' to list here - the exposure was caused by misconfigured authorization scopes in role definitions rather than flawed function logic.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ethyca-fides | pip | < 2.22.1 | 2.22.1 |
PythonPythonOngoing coverage of React2Shell