-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/usememos/memos | go | < 0.21.0 | 0.21.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the pre-patch CORSMiddleware implementation in server/server.go. The function unconditionally set Access-Control-Allow-Origin to the request's Origin header (line 163 in v0.20.1) while keeping credentials enabled. The commit 8101a5e fixed this by adding origin validation through allowedOrigins. The combination of origin reflection and credential allowance created the CORS misconfiguration described in CWE-942.