-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from missing authorization checks in user management endpoints. The commit diff shows added admin checks in users.py's post() and patch() methods. These functions previously allowed users with admin:users scope to set admin=True without being admins themselves. The tests in test_api.py validate these scenarios but are not themselves vulnerable. The core issue was in the API handlers' failure to verify admin status before processing privilege changes.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| jupyterhub | pip | < 4.1.6 | 4.1.6 |
| jupyterhub | pip | >= 5.0.0, < 5.1.0 | 5.1.0 |
Ongoing coverage of React2Shell