-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from removed/absent authentication checks in GraphQL resolver functions. The commit diff shows removal of user presence validation in multiple admin endpoints (e.g., adminUser, adminUsers, customers queries). These resolvers handle sensitive operations but lacked proper authorization checks, allowing unauthenticated access. The pattern matches CWE-285/287 by exposing admin functionalities without proper access control. High confidence comes from direct evidence in commit diffs showing removal of auth checks in critical admin endpoints.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @evershop/evershop | npm | < 1.0.0-rc.9 | 1.0.0-rc.9 |
JavaScriptJavaScriptOngoing coverage of React2Shell