-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from incorrect parameter binding in the can_manage_channel decorator. Before the patch, the function called _can_manage_channel_deco(allow_thread_owner) without keyword arguments, misassigning the boolean 'allow_thread_owner' value to the 'privilege_level' parameter. This caused privilege checks to compare PrivilegeLevel enum values against boolean equivalents (0/1), which always evaluated as True for users with any privilege level. The fix enforced keyword arguments and proper parameter assignment.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Red-DiscordBot | pip | >= 3.5.0, < 3.5.10 | 3.5.10 |