-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability manifests in the admin interface's collection deletion endpoint which accepts POST requests with _method=delete override without CSRF protection. The POC demonstrates that simply submitting a form with these parameters triggers collection deletion. Since Express applications typically require explicit CSRF middleware protection for state-changing operations, the absence of such protection in the route handler for admin collection deletion constitutes the vulnerability. The high confidence comes from the reproducible POC and the CVE's explicit mention of /admin endpoint CSRF vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mongo-express | npm | <= 1.0.2 |
Ongoing coverage of React2Shell