-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| directus | npm | >= 11.0.0, < 11.3.0 | 11.3.0 |
| @directus/api | npm | >= 22.2.0, < 23.2.0 | 23.2.0 |
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stems from WebSocket connection handlers initializing accountability to null. The commit diff shows both base.ts and graphql.ts were modified to replace 'null' with createDefaultAccountability(). These locations directly control authentication state for WebSocket connections, and null accountability (post-Permissions Policy update) erroneously granted admin access instead of public permissions. The files/line changes match the vulnerability description and CWE-200 exposure pattern.
Ongoing coverage of React2Shell