-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper access control in User entity handling within SettingController. The pull request #4878 specifically modifies these two methods: 1) IsAuthorized was changed from a conditional OR check to a unified permissions check, and 2) FilterPrivate was updated to use proper permission validation instead of direct role checks. These changes indicate the original implementations lacked server-side validation of the entityid parameter, trusting client-provided values instead of re-validating against the authenticated user's context. The associated CWE-290 and vulnerability description about parameter manipulation align perfectly with these code changes.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Oqtane.Framework | nuget | <= 6.0.0 | |
| Oqtane.Server | nuget | <= 6.0.0 |
Ongoing coverage of React2Shell