-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RubyRubyMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper handling of concurrent endorsement creation requests and inconsistent null/0 values for user_group_id. The key fixes were: 1) Adding RecordNotUnique exception handling in EndorseResource#call to catch race conditions, 2) Standardizing on 0 instead of nil for user_group_id in queries to enforce unique constraints, and 3) Updating endorsement checks to match the 0 default value. These changes indicate the original functions lacked proper synchronization and consistent unique constraint enforcement.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| decidim | rubygems | >= 0.10.0, < 0.26.9 | 0.26.9 |
| decidim | rubygems | >= 0.27.0, < 0.27.5 | 0.27.5 |
Ongoing coverage of React2Shell