-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper permission mapping between UI menu access and resource read operations. Key issues were: 1) The _get_user_permissions function merged ACTION_CAN_ACCESS_MENU into ACTION_CAN_READ, creating implicit privilege escalation. 2) The is_authorized_view function used HTTP GET method checks for menu access (AccessView.DOCS) instead of dedicated MENU permission validation. The patch added explicit MENU permission handling and separated these permission checks, confirming these were the vulnerable points.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| apache-airflow | pip | >= 2.8.0, < 2.8.3rc1 | 2.8.3rc1 |