-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: 1) The frontend sent user identifiers as 'id' which was later standardized to 'user_id', but more critically 2) The backend in users.queries.php lacked proper authorization checks when handling these parameters. The patch adds multiple security layers: a) Centralized parameter validation, b) User privilege checks, and c) Forced user_id overriding for non-admins. The vulnerable functions are the various case handlers that previously accepted user-controlled IDs without verifying if the requester had rights to modify the target user. The CWEs (472/639) directly map to these patterns of unvalidated parameter usage and authorization bypass.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nilsteampassnet/teampass | composer | < 3.1.3.1 | 3.1.3.1 |
Ongoing coverage of React2Shell