-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper access control in DELETE request handling. The key evidence is in the commit diff where the DELETE method's validator was changed from validate_can_update_experiment_artifact_proxy (checking update permission) to validate_can_delete_experiment_artifact_proxy (checking manage permission). The original implementation in _get_proxy_artifact_validator incorrectly associated DELETE operations with update permissions, and validate_can_update_experiment_artifact_proxy was the flawed authorization check enabling this.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mlflow | pip | < 2.10.1 | 2.10.1 |