-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/stacklok/minder | go | < 0.0.33 | 0.0.33 |
Miggo AIRoot Cause AnalysisThe core vulnerability stemmed from the GetRepositoryByRepoName SQL query missing project_id in its WHERE clause. This allowed any authenticated user with valid provider credentials to access/modify repositories by name/owner regardless of project ownership. The handler functions (Get/DeleteRepositoryByName, GetArtifactByName) propagated this flaw by not including project context in their database calls. The commit diff explicitly shows project_id being added to both the SQL query and all handler call sites to fix authorization checks.
A Semantic Attack on Google Gemini - Read the Latest Research