-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing dynamic permission enforcement in Community edition. The patch adds dynamic authorization checks by: 1) Introducing DynamicPermissionsChecks configuration, 2) Modifying PermissionServiceImpl.isAuthorized to check both static and dynamic permissions, and 3) Removing deprecated checkAPICallWithScript. The core vulnerability existed in the authorization flow handled by PermissionServiceImpl.isAuthorized, which previously only performed static checks in Community editions, leaving user-controlled resource access unvalidated.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.bonitasoft.engine:bonita-server | maven | < 10.1.0.W11 | 10.1.0.W11 |