-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| derhansen/sf_event_mgt | composer | >= 7.0.0, < 7.4.0 | 7.4.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the fact that checkEventAccess() in the affected versions called $this->redirect('list') but did not return the RedirectResponse. Controller actions like exportAction, indexNotifyAction, and notifyAction relied on checkEventAccess to enforce access control but continued execution even when a redirect was triggered. The commit diff explicitly modifies these functions to check the return value of checkEventAccess and return the redirect, confirming their role in the vulnerability. The CVE description and patch context directly link the unhandled RedirectResponse to these functions.
PHPPHPOngoing coverage of React2Shell