-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/openfga/openfga | go | >= 1.5.7, < 1.5.9 | 1.5.9 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of 'but not' exclusions combined with 'from'-defined usersets during authorization checks. The Check API's core evaluation logic (likely in check.go) and the policy engine's exclusion processor (likely in policy_evaluator.go) are prime candidates, as these components would directly handle the combination of negation and userset resolution. The medium confidence reflects the lack of explicit patch details, but aligns with the described attack vector involving model expression evaluation flaws.
GoGoKEV Misses 88% of Exploited CVEs- Get the report